code: func (gsa *GServiceAccount) Signer() (jwt.Signer, error) {
  	gsa.mu.Lock()
  	defer gsa.mu.Unlock()
  
  	if gsa.signer == nil {
  		keyset, err := pemutil.DecodeBytes([]byte(gsa.PrivateKey))
  		if err != nil {
  			return nil, fmt.Errorf("jwt/gserviceaccount: could not decode private key: %v", err)
  		}
  		keyset.AddPublicKeys()
  
  		s, err := DefaultAlgorithm.New(keyset)
  		if err != nil {
  			return nil, err
  		}
  		gsa.signer = s
  	}
  
  	return gsa.signer, nil
  }
docs: // Signer returns a jwt.Signer for use when signing tokens.