code: func NewPublicKeys(user string, pemBytes []byte, password string) (*PublicKeys, error) {
  	block, _ := pem.Decode(pemBytes)
  	if block == nil {
  		return nil, errors.New("invalid PEM data")
  	}
  	if x509.IsEncryptedPEMBlock(block) {
  		key, err := x509.DecryptPEMBlock(block, []byte(password))
  		if err != nil {
  			return nil, err
  		}
  
  		block = &pem.Block{Type: block.Type, Bytes: key}
  		pemBytes = pem.EncodeToMemory(block)
  	}
  
  	signer, err := ssh.ParsePrivateKey(pemBytes)
  	if err != nil {
  		return nil, err
  	}
  
  	return &PublicKeys{User: user, Signer: signer}, nil
  }
docs: // NewPublicKeys returns a PublicKeys from a PEM encoded private key. An
  // encryption password should be given if the pemBytes contains a password
  // encrypted PEM block otherwise password should be empty. It supports RSA
  // (PKCS#1), DSA (OpenSSL), and ECDSA private keys.