code: func CreateServiceAccountKeyAndPublicKeyFiles(certsDir string) error {
  	klog.V(1).Infoln("creating a new public/private key files for signing service account users")
  	_, err := keyutil.PrivateKeyFromFile(filepath.Join(certsDir, kubeadmconstants.ServiceAccountPrivateKeyName))
  	if err == nil {
  		// kubeadm doesn't validate the existing certificate key more than this;
  		// Basically, if we find a key file with the same path kubeadm thinks those files
  		// are equal and doesn't bother writing a new file
  		fmt.Printf("[certs] Using the existing %q key\n", kubeadmconstants.ServiceAccountKeyBaseName)
  		return nil
  	} else if !os.IsNotExist(err) {
  		return errors.Wrapf(err, "file %s existed but it could not be loaded properly", kubeadmconstants.ServiceAccountPrivateKeyName)
  	}
  
  	// The key does NOT exist, let's generate it now
  	key, err := pkiutil.NewPrivateKey()
  	if err != nil {
  		return err
  	}
  
  	// Write .key and .pub files to disk
  	fmt.Printf("[certs] Generating %q key and public key\n", kubeadmconstants.ServiceAccountKeyBaseName)
  
  	if err := pkiutil.WriteKey(certsDir, kubeadmconstants.ServiceAccountKeyBaseName, key); err != nil {
  		return err
  	}
  
  	return pkiutil.WritePublicKey(certsDir, kubeadmconstants.ServiceAccountKeyBaseName, key.Public())
  }
docs: // CreateServiceAccountKeyAndPublicKeyFiles create a new public/private key files for signing service account users.
  // If the sa public/private key files already exists in the target folder, they are used only if evaluated equals; otherwise an error is returned.