code: func (c *Certificate) Marshal() []byte {
  	generic := genericCertData{
  		Serial:          c.Serial,
  		CertType:        c.CertType,
  		KeyId:           c.KeyId,
  		ValidPrincipals: marshalStringList(c.ValidPrincipals),
  		ValidAfter:      uint64(c.ValidAfter),
  		ValidBefore:     uint64(c.ValidBefore),
  		CriticalOptions: marshalTuples(c.CriticalOptions),
  		Extensions:      marshalTuples(c.Extensions),
  		Reserved:        c.Reserved,
  		SignatureKey:    c.SignatureKey.Marshal(),
  	}
  	if c.Signature != nil {
  		generic.Signature = Marshal(c.Signature)
  	}
  	genericBytes := Marshal(&generic)
  	keyBytes := c.Key.Marshal()
  	_, keyBytes, _ = parseString(keyBytes)
  	prefix := Marshal(&struct {
  		Name  string
  		Nonce []byte
  		Key   []byte `ssh:"rest"`
  	}{c.Type(), c.Nonce, keyBytes})
  
  	result := make([]byte, 0, len(prefix)+len(genericBytes))
  	result = append(result, prefix...)
  	result = append(result, genericBytes...)
  	return result
  }
docs: // Marshal serializes c into OpenSSH's wire format. It is part of the
  // PublicKey interface.