code: func NewCertSigner(cert *Certificate, signer Signer) (Signer, error) {
  	if bytes.Compare(cert.Key.Marshal(), signer.PublicKey().Marshal()) != 0 {
  		return nil, errors.New("ssh: signer and cert have different public key")
  	}
  
  	return &openSSHCertSigner{cert, signer}, nil
  }
docs: // NewCertSigner returns a Signer that signs with the given Certificate, whose
  // private key is held by signer. It returns an error if the public key in cert
  // doesn't match the key used by signer.