code: func NewIAMTokenProvider(ctx context.Context, actAs string, scopes []string, transport http.RoundTripper) (TokenProvider, error) {
  	return &iamTokenProvider{
  		actAs:     actAs,
  		scopes:    scopes,
  		transport: transport,
  		cacheKey: CacheKey{
  			Key:    fmt.Sprintf("iam/%s", actAs),
  			Scopes: scopes,
  		},
  	}, nil
  }
docs: // NewIAMTokenProvider returns TokenProvider that uses SignBlob IAM API to
  // sign assertions on behalf of some service account.