code: func decryptPEMBlock(c *Client, block *pem.Block, path string, key []byte) ([]byte, error) {
  	fileurl := fmt.Sprintf("cert:///%s", filepath.ToSlash(path))
  	url, err := url.Parse(fileurl)
  	if err != nil {
  		return nil, err
  	}
  	credHelper, input := c.credHelperContext.GetCredentialHelper(nil, url)
  
  	input["username"] = ""
  
  	creds, err := credHelper.Fill(input)
  	if err != nil {
  		tracerx.Printf("Error filling credentials for %q: %v", fileurl, err)
  		return nil, err
  	}
  	pass := creds["password"]
  	decrypted, err := x509.DecryptPEMBlock(block, []byte(pass))
  	if err != nil {
  		credHelper.Reject(creds)
  		return nil, err
  	}
  	credHelper.Approve(creds)
  
  	// decrypted is a DER blob, but we need a PEM-encoded block.
  	toEncode := &pem.Block{Type: block.Type, Headers: nil, Bytes: decrypted}
  	buf := pem.EncodeToMemory(toEncode)
  	return buf, nil
  }
docs: // decryptPEMBlock decrypts an encrypted PEM block representing a private key,
  // prompting for credentials using the credential helper, and returns a
  // decrypted PEM block representing that same private key.