code: func newLocalSigner(keyBytes, certBytes []byte, certExpiry time.Duration, rootPool, intermediatePool *x509.CertPool) (*LocalSigner, error) {
  	if len(keyBytes) == 0 || len(certBytes) == 0 {
  		return nil, errors.New("must provide both a signing key and a signing cert, or neither")
  	}
  
  	parsedCerts, err := helpers.ParseCertificatesPEM(certBytes)
  	if err != nil {
  		return nil, errors.Wrap(err, "invalid signing CA cert")
  	}
  	if len(parsedCerts) == 0 {
  		return nil, errors.New("no valid signing CA certificates found")
  	}
  	if err := validateSignatureAlgorithm(parsedCerts[0]); err != nil {
  		return nil, err
  	}
  	opts := x509.VerifyOptions{
  		Roots:         rootPool,
  		Intermediates: intermediatePool,
  	}
  	if _, err := parsedCerts[0].Verify(opts); err != nil {
  		return nil, errors.Wrap(err, "error while validating signing CA certificate against roots and intermediates")
  	}
  
  	// The key should not be encrypted, but it could be in PKCS8 format rather than PKCS1
  	priv, err := helpers.ParsePrivateKeyPEM(keyBytes)
  	if err != nil {
  		return nil, errors.Wrap(err, "malformed private key")
  	}
  
  	// We will always use the first certificate inside of the root bundle as the active one
  	if err := ensureCertKeyMatch(parsedCerts[0], priv.Public()); err != nil {
  		return nil, err
  	}
  
  	signer, err := local.NewSigner(priv, parsedCerts[0], cfsigner.DefaultSigAlgo(priv), SigningPolicy(certExpiry))
  	if err != nil {
  		return nil, err
  	}
  
  	return &LocalSigner{Cert: certBytes, Key: keyBytes, Signer: signer, parsedCert: parsedCerts[0], cryptoSigner: priv}, nil
  }
docs: // newLocalSigner validates the signing cert and signing key to create a local signer, which accepts a crypto signer and a cert