code: func getKeyringMembers(ctx context.Context, client *registry.Client,
  	orgID *identity.ID) ([]keyringMember, error) {
  
  	teams, err := client.Teams.GetByOrg(ctx, orgID)
  	if err != nil {
  		return nil, err
  	}
  
  	membersTeam, machinesTeam, err := findSystemTeams(teams)
  	if err != nil {
  		return nil, err
  	}
  
  	userMembers, err := client.Memberships.List(ctx, orgID, membersTeam.ID, nil)
  	if err != nil {
  		return nil, err
  	}
  
  	machineMembers, err := client.Memberships.List(ctx, orgID, machinesTeam.ID, nil)
  	if err != nil {
  		return nil, err
  	}
  
  	var members []keyringMember
  	for _, membership := range userMembers {
  		members = append(members, &userKeyringMember{id: membership.Body.OwnerID})
  	}
  
  	for _, membership := range machineMembers {
  		machineID := membership.Body.OwnerID
  		segment, err := client.Machines.Get(ctx, machineID)
  		if err != nil {
  			return nil, err
  		}
  
  		m := machineKeyringMember{Machine: segment.Machine}
  		for _, token := range segment.Tokens {
  			if token.Token.Body.State == primitive.MachineTokenActiveState {
  				m.tokens = append(m.tokens, *token.Token.ID)
  			}
  		}
  		members = append(members, &m)
  	}
  
  	return members, nil
  }
docs: // getKeyringMembers returns a slice of keyringMembers of all subjects that
  // should be members of a keyring.
  // This includes both users and machines.
  // XXX: we need to filter the members down based on ACL