code: func (m *Manager) Marshal() string {
  	m.init()
  	m.mu.Lock()
  	js, err := json.MarshalIndent(&m.state, "", "\t")
  	m.mu.Unlock()
  	if err != nil {
  		panic("unexpected json.Marshal failure")
  	}
  	return string(js)
  }
docs: // Marshal returns an encoding of the manager's state,
  // suitable for writing to disk and reloading by calling Unmarshal.
  // The state includes registration status, the configured host list
  // from SetHosts, and all known certificates, including their private
  // cryptographic keys.
  // Consequently, the state should be kept private.