code: func (k *Key) TLSCertValidBefore() (t time.Time, err error) {
  	cert, err := tlsca.ParseCertificatePEM(k.TLSCert)
  	if err != nil {
  		return t, trace.Wrap(err)
  	}
  	return cert.NotAfter, nil
  }
docs: // TLSCertValidBefore returns the time of the TLS cert expiration