code: func (pc *PublicCertificates) CertificateForKey(key string) (*x509.Certificate, error) {
  	// Use fast reader lock first.
  	pc.lock.RLock()
  	cert, ok := pc.cache[key]
  	pc.lock.RUnlock()
  	if ok {
  		return cert, nil
  	}
  
  	// Grab the write lock and recheck the cache.
  	pc.lock.Lock()
  	defer pc.lock.Unlock()
  	if cert, ok := pc.cache[key]; ok {
  		return cert, nil
  	}
  
  	for _, cert := range pc.Certificates {
  		if cert.KeyName == key {
  			block, _ := pem.Decode([]byte(cert.X509CertificatePEM))
  			if block == nil {
  				return nil, fmt.Errorf("signature: the certificate %q is not PEM encoded", key)
  			}
  			cert, err := x509.ParseCertificate(block.Bytes)
  			if err != nil {
  				return nil, err
  			}
  			if pc.cache == nil {
  				pc.cache = make(map[string]*x509.Certificate)
  			}
  			pc.cache[key] = cert
  			return cert, nil
  		}
  	}
  
  	return nil, fmt.Errorf("signature: no such certificate %q", key)
  }
docs: // CertificateForKey finds the certificate for given key and deserializes it.