code: func (c *ca) NewClientCertKeyPair() (*CertKeyPair, error) {
  	return newCertKeyPair(false, false, "", c.caCert.Signer, c.caCert.TLSCert)
  }
docs: // newClientCertKeyPair returns a certificate and private key pair and nil,
  // or nil, error in case of failure
  // The certificate is signed by the CA and is used as a client TLS certificate