code: func JWTTokenGenerator(iss string, privateKey interface{}) (TokenGenerator, error) {
  	var alg jose.SignatureAlgorithm
  	switch pk := privateKey.(type) {
  	case *rsa.PrivateKey:
  		alg = jose.RS256
  	case *ecdsa.PrivateKey:
  		switch pk.Curve {
  		case elliptic.P256():
  			alg = jose.ES256
  		case elliptic.P384():
  			alg = jose.ES384
  		case elliptic.P521():
  			alg = jose.ES512
  		default:
  			return nil, fmt.Errorf("unknown private key curve, must be 256, 384, or 521")
  		}
  	case jose.OpaqueSigner:
  		alg = jose.SignatureAlgorithm(pk.Public().Algorithm)
  	default:
  		return nil, fmt.Errorf("unknown private key type %T, must be *rsa.PrivateKey, *ecdsa.PrivateKey, or jose.OpaqueSigner", privateKey)
  	}
  
  	signer, err := jose.NewSigner(
  		jose.SigningKey{
  			Algorithm: alg,
  			Key:       privateKey,
  		},
  		nil,
  	)
  	if err != nil {
  		return nil, err
  	}
  	return &jwtTokenGenerator{
  		iss:    iss,
  		signer: signer,
  	}, nil
  }
docs: // JWTTokenGenerator returns a TokenGenerator that generates signed JWT tokens, using the given privateKey.
  // privateKey is a PEM-encoded byte array of a private RSA key.
  // JWTTokenAuthenticator()