code: func (sp *StandardProvider) Load() (err error) {
  	if !sp.Persistent() {
  		return
  	}
  
  	var clearKey = true
  	defer func() {
  		if err != nil {
  			if clearKey {
  				sp.resetKey()
  			}
  			sp.resetCert()
  		}
  	}()
  
  	sp.internal.keyPEM, err = ioutil.ReadFile(sp.Paths.KeyFile)
  	if err != nil {
  		return
  	}
  
  	sp.internal.priv, err = helpers.ParsePrivateKeyPEM(sp.internal.keyPEM)
  	if err != nil {
  		return
  	}
  
  	clearKey = false
  
  	sp.internal.certPEM, err = ioutil.ReadFile(sp.Paths.CertFile)
  	if err != nil {
  		return ErrCertificateUnavailable
  	}
  
  	sp.internal.cert, err = helpers.ParseCertificatePEM(sp.internal.certPEM)
  	if err != nil {
  		err = errors.New("transport: invalid certificate")
  		return
  	}
  
  	p, _ := pem.Decode(sp.internal.keyPEM)
  
  	switch sp.internal.cert.PublicKey.(type) {
  	case *rsa.PublicKey:
  		if p.Type != "RSA PRIVATE KEY" {
  			err = errors.New("transport: PEM type " + p.Type + " is invalid for an RSA key")
  			return
  		}
  	case *ecdsa.PublicKey:
  		if p.Type != "EC PRIVATE KEY" {
  			err = errors.New("transport: PEM type " + p.Type + " is invalid for an ECDSA key")
  			return
  		}
  	default:
  		err = errors.New("transport: invalid public key type")
  	}
  
  	if err != nil {
  		clearKey = true
  		return
  	}
  
  	return nil
  }
docs: // Load a private key and certificate from disk.