code: func DeriveLoginKeypair(ctx context.Context, secret []byte, salt *base64url.Value) (
  	*LoginKeypair, error) {
  
  	key, err := deriveHash(ctx, secret, salt.String())
  	if err != nil {
  		return nil, err
  	}
  
  	err = ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, err
  	}
  
  	r := bytes.NewReader(key[224:]) // Use last 32 bytes of 256 to derive key
  	pubKey, privKey, err := ed25519.GenerateKey(r)
  	if err != nil {
  		return nil, err
  	}
  
  	err = ctxutil.ErrIfDone(ctx)
  	if err != nil {
  		return nil, err
  	}
  
  	keypair := &LoginKeypair{
  		public:  pubKey,
  		private: privKey,
  		salt:    salt,
  	}
  	return keypair, nil
  }
docs: // DeriveLoginKeypair dervies the ed25519 login keypair used for machine
  // authentication from the given salt and secret values.