code: func (k *Key) CertValidBefore() (t time.Time, err error) {
  	pcert, _, _, _, err := ssh.ParseAuthorizedKey(k.Cert)
  	if err != nil {
  		return t, trace.Wrap(err)
  	}
  	cert, ok := pcert.(*ssh.Certificate)
  	if !ok {
  		return t, trace.Errorf("not supported certificate type")
  	}
  	return time.Unix(int64(cert.ValidBefore), 0), nil
  }
docs: // CertValidBefore returns the time of the cert expiration