code: func (k *KeyReadWriter) Migrate() error {
  	tmpPaths := k.genTempPaths()
  	keyBytes, err := ioutil.ReadFile(tmpPaths.Key)
  	if err != nil {
  		return nil // no key?  no migration
  	}
  
  	// it does exist - no need to decrypt, because previous versions of swarmkit
  	// which supported this temporary key did not support encrypting TLS keys
  	cert, err := ioutil.ReadFile(k.paths.Cert)
  	if err != nil {
  		return os.RemoveAll(tmpPaths.Key) // no cert?  no migration
  	}
  
  	// nope, this does not match the cert
  	if _, err = tls.X509KeyPair(cert, keyBytes); err != nil {
  		return os.RemoveAll(tmpPaths.Key)
  	}
  
  	return os.Rename(tmpPaths.Key, k.paths.Key)
  }
docs: // Migrate checks to see if a temporary key file exists.  Older versions of
  // swarmkit wrote temporary keys instead of temporary certificates, so
  // migrate that temporary key if it exists.  We want to write temporary certificates,
  // instead of temporary keys, because we may need to periodically re-encrypt the
  // keys and modify the headers, and it's easier to have a single canonical key
  // location than two possible key locations.