code: func getSPEncryptionCert(sp *Metadata) []byte {
  	cert := ""
  	for _, keyDescriptor := range sp.SPSSODescriptor.KeyDescriptor {
  		if keyDescriptor.Use == "encryption" {
  			cert = keyDescriptor.KeyInfo.Certificate
  			break
  		}
  	}
  
  	// If there are no explicitly signing certs, just return the first
  	// non-empty cert we find.
  	if cert == "" {
  		for _, keyDescriptor := range sp.SPSSODescriptor.KeyDescriptor {
  			if keyDescriptor.Use == "" && keyDescriptor.KeyInfo.Certificate != "" {
  				cert = keyDescriptor.KeyInfo.Certificate
  				break
  			}
  		}
  	}
  
  	if cert == "" {
  		return nil
  	}
  
  	// cleanup whitespace and re-encode a PEM
  	cert = regexp.MustCompile("\\s+").ReplaceAllString(cert, "")
  	certBytes, _ := base64.StdEncoding.DecodeString(cert)
  	certBytes = pem.EncodeToMemory(&pem.Block{
  		Type:  "CERTIFICATE",
  		Bytes: certBytes})
  	return certBytes
  }
docs: // getSPEncryptionCert returns the certificate which we can use to encrypt things
  // to the SP in PEM format, or nil if no such certificate is found.