code: func (msp *bccspmsp) deserializeIdentityInternal(serializedIdentity []byte) (Identity, error) {
  	// This MSP will always deserialize certs this way
  	bl, _ := pem.Decode(serializedIdentity)
  	if bl == nil {
  		return nil, errors.New("could not decode the PEM structure")
  	}
  	cert, err := x509.ParseCertificate(bl.Bytes)
  	if err != nil {
  		return nil, errors.Wrap(err, "parseCertificate failed")
  	}
  
  	// Now we have the certificate; make sure that its fields
  	// (e.g. the Issuer.OU or the Subject.OU) match with the
  	// MSP id that this MSP has; otherwise it might be an attack
  	// TODO!
  	// We can't do it yet because there is no standardized way
  	// (yet) to encode the MSP ID into the x.509 body of a cert
  
  	pub, err := msp.bccsp.KeyImport(cert, &bccsp.X509PublicKeyImportOpts{Temporary: true})
  	if err != nil {
  		return nil, errors.WithMessage(err, "failed to import certificate's public key")
  	}
  
  	return newIdentity(cert, pub, msp)
  }
docs: // deserializeIdentityInternal returns an identity given its byte-level representation