code: func MarshalPublicKeyFromPrivateKeyPEM(privateKey crypto.PrivateKey) ([]byte, error) {
  	rsaPrivateKey, ok := privateKey.(*rsa.PrivateKey)
  	if !ok {
  		return nil, trace.BadParameter("expected RSA key")
  	}
  	rsaPublicKey := rsaPrivateKey.Public()
  	derBytes, err := x509.MarshalPKIXPublicKey(rsaPublicKey)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	return pem.EncodeToMemory(&pem.Block{Type: "RSA PUBLIC KEY", Bytes: derBytes}), nil
  }
docs: // MarshalPublicKeyFromPrivateKeyPEM extracts public key from private key
  // and returns PEM marshalled key