code: func createCertificate(principal string, certType uint32, caKey crypto.Signer, key crypto.Signer) (*ssh.Certificate, ssh.Signer, error) {
  	// Create CA.
  	caPublicKey, err := ssh.NewPublicKey(caKey.Public())
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  	caSigner, err := ssh.NewSignerFromKey(caKey)
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  
  	// Create key.
  	publicKey, err := ssh.NewPublicKey(key.Public())
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  	keySigner, err := ssh.NewSignerFromKey(key)
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  
  	// Create certificate and signer.
  	cert := &ssh.Certificate{
  		KeyId:           principal,
  		ValidPrincipals: []string{principal},
  		Key:             publicKey,
  		SignatureKey:    caPublicKey,
  		ValidAfter:      uint64(time.Now().UTC().Add(-1 * time.Minute).Unix()),
  		ValidBefore:     uint64(time.Now().UTC().Add(1 * time.Minute).Unix()),
  		CertType:        certType,
  	}
  	err = cert.SignCert(rand.Reader, caSigner)
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  	certSigner, err := ssh.NewCertSigner(cert, keySigner)
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  
  	return cert, certSigner, nil
  }
docs: // createCertificate creates a SSH certificate for the given key signed by the
  // given CA key. This function exists here to allow easy key generation for
  // some of the more core packages like "sshutils".