code: func (c *SessionContext) GetAgent() (agent.Agent, *ssh.Certificate, error) {
  	pub, _, _, _, err := ssh.ParseAuthorizedKey(c.sess.GetPub())
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  	cert, ok := pub.(*ssh.Certificate)
  	if !ok {
  		return nil, nil, trace.BadParameter("expected certificate, got %T", pub)
  	}
  	if len(cert.ValidPrincipals) == 0 {
  		return nil, nil, trace.BadParameter("expected at least valid principal in certificate")
  	}
  	privateKey, err := ssh.ParseRawPrivateKey(c.sess.GetPriv())
  	if err != nil {
  		return nil, nil, trace.Wrap(err, "failed to parse SSH private key")
  	}
  
  	keyring := agent.NewKeyring()
  	err = keyring.Add(agent.AddedKey{
  		PrivateKey:  privateKey,
  		Certificate: cert,
  	})
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  	return keyring, cert, nil
  }
docs: // GetAgent returns agent that can be used to answer challenges
  // for the web to ssh connection as well as certificate