code: func New(certPEM, keyPEM []byte) (*CertAuthority, error) {
  	ca := &CertAuthority{}
  	var err error
  	ca.Cert, err = ParseCertificatePEM(certPEM)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	if len(keyPEM) != 0 {
  		ca.Signer, err = ParsePrivateKeyPEM(keyPEM)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  	}
  	return ca, nil
  }
docs: // New returns new CA from PEM encoded certificate and private
  // key. Private Key is optional, if omitted CA won't be able to
  // issue new certificates, only verify them