code: func keyID(raw interface{}) ([]byte, error) {
  	switch raw.(type) {
  	case *ecdsa.PublicKey:
  	default:
  		return nil, fmt.Errorf("invalid key type: %T", raw)
  	}
  
  	// This is not standard; RFC allows any unique identifier as long as they
  	// match in subject/authority chains but suggests specific hashing of DER
  	// bytes of public key including DER tags.
  	bs, err := x509.MarshalPKIXPublicKey(raw)
  	if err != nil {
  		return nil, err
  	}
  
  	// String formatted
  	kID := sha256.Sum256(bs)
  	return []byte(strings.Replace(fmt.Sprintf("% x", kID), " ", ":", -1)), nil
  }
docs: // KeyId returns a x509 KeyId from the given signing key.