code: func (i *TeleInstance) NewClient(cfg ClientConfig) (*client.TeleportClient, error) {
  	tc, err := i.NewUnauthenticatedClient(cfg)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// configures the client authenticate using the keys from 'secrets':
  	user, ok := i.Secrets.Users[cfg.Login]
  	if !ok {
  		return nil, trace.BadParameter("unknown login %q", cfg.Login)
  	}
  	if user.Key == nil {
  		return nil, trace.BadParameter("user %q has no key", cfg.Login)
  	}
  	_, err = tc.AddKey(cfg.Host, user.Key)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	// tell the client to trust given CAs (from secrets). this is the
  	// equivalent of 'known hosts' in openssh
  	cas := i.Secrets.GetCAs()
  	for i := range cas {
  		err = tc.AddTrustedCA(cas[i])
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  	}
  	return tc, nil
  }
docs: // NewClient returns a fully configured and pre-authenticated client
  // (pre-authenticated with server CAs and signed session key)