code: func New(before time.Duration, identity *core.Identity) (*Transport, error) {
  	var tr = &Transport{
  		Before:   before,
  		Identity: identity,
  		Backoff:  &backoff.Backoff{},
  	}
  
  	store, err := roots.New(identity.Roots)
  	if err != nil {
  		return nil, err
  	}
  	tr.TrustStore = store
  
  	if len(identity.ClientRoots) > 0 {
  		store, err = roots.New(identity.ClientRoots)
  		if err != nil {
  			return nil, err
  		}
  		tr.ClientTrustStore = store
  	}
  
  	tr.Provider, err = NewKeyProvider(identity)
  	if err != nil {
  		return nil, err
  	}
  
  	tr.CA, err = NewCA(identity)
  	if err != nil {
  		return nil, err
  	}
  
  	return tr, nil
  }
docs: // New builds a new transport from an identity and a before time. The
  // before time tells the transport how long before the certificate
  // expires to start attempting to update when auto-updating. If before
  // is longer than the certificate's lifetime, every update check will
  // trigger a new certificate to be generated.