code: func downloadKey(u *url.URL, skipTLSCheck bool) (*os.File, error) {
  	tf, err := ioutil.TempFile("", "")
  	if err != nil {
  		return nil, errwrap.Wrap(errors.New("error creating tempfile"), err)
  	}
  	os.Remove(tf.Name()) // no need to keep the tempfile around
  
  	defer func() {
  		if tf != nil {
  			tf.Close()
  		}
  	}()
  
  	// TODO(krnowak): we should probably apply credential headers
  	// from config here
  	var client *http.Client
  	if skipTLSCheck {
  		client = insecureClient
  	} else {
  		client = secureClient
  	}
  
  	res, err := client.Get(u.String())
  	if err != nil {
  		return nil, errwrap.Wrap(errors.New("error getting key"), err)
  	}
  	defer res.Body.Close()
  
  	if res.StatusCode != http.StatusOK {
  		return nil, fmt.Errorf("bad HTTP status code: %d", res.StatusCode)
  	}
  
  	if _, err := io.Copy(tf, res.Body); err != nil {
  		return nil, errwrap.Wrap(errors.New("error copying key"), err)
  	}
  
  	if _, err = tf.Seek(0, os.SEEK_SET); err != nil {
  		return nil, errwrap.Wrap(errors.New("error seeking"), err)
  	}
  
  	retTf := tf
  	tf = nil
  	return retTf, nil
  }
docs: // downloadKey retrieves the file, storing it in a deleted tempfile