code: func (k *Key) ClientTLSConfig() (*tls.Config, error) {
  	// Because Teleport clients can't be configured (yet), they take the default
  	// list of cipher suites from Go.
  	tlsConfig := utils.TLSConfig(nil)
  
  	pool := x509.NewCertPool()
  	for _, ca := range k.TrustedCA {
  		for _, certPEM := range ca.TLSCertificates {
  			if !pool.AppendCertsFromPEM(certPEM) {
  				return nil, trace.BadParameter("failed to parse certificate received from the proxy")
  			}
  		}
  	}
  	tlsConfig.RootCAs = pool
  	tlsCert, err := tls.X509KeyPair(k.TLSCert, k.Priv)
  	if err != nil {
  		return nil, trace.Wrap(err, "failed to parse TLS cert and key")
  	}
  	tlsConfig.Certificates = append(tlsConfig.Certificates, tlsCert)
  	return tlsConfig, nil
  }
docs: // TLSConfig returns client TLS configuration used
  // to authenticate against API servers