code: func getOrGenerateNotaryKey(notaryRepo client.Repository, role data.RoleName) (data.PublicKey, error) {
  	// use the signer name in the PEM headers if this is a delegation key
  	if data.IsDelegation(role) {
  		role = data.RoleName(notaryRoleToSigner(role))
  	}
  	keys := notaryRepo.GetCryptoService().ListKeys(role)
  	var err error
  	var key data.PublicKey
  	// always select the first key by ID
  	if len(keys) > 0 {
  		sort.Strings(keys)
  		keyID := keys[0]
  		privKey, _, err := notaryRepo.GetCryptoService().GetPrivateKey(keyID)
  		if err != nil {
  			return nil, err
  		}
  		key = data.PublicKeyFromPrivate(privKey)
  	} else {
  		key, err = notaryRepo.GetCryptoService().Create(role, "", data.ECDSAKey)
  		if err != nil {
  			return nil, err
  		}
  	}
  	return key, nil
  }
docs: // generates an ECDSA key without a GUN for the specified role