code: func (a *Authenticator) UpdateTransportConfig(c *transport.Config) error {
  	c.Wrap(func(rt http.RoundTripper) http.RoundTripper {
  		return &roundTripper{a, rt}
  	})
  
  	if c.TLS.GetCert != nil {
  		return errors.New("can't add TLS certificate callback: transport.Config.TLS.GetCert already set")
  	}
  	c.TLS.GetCert = a.cert
  
  	var dial func(ctx context.Context, network, addr string) (net.Conn, error)
  	if c.Dial != nil {
  		dial = c.Dial
  	} else {
  		dial = (&net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}).DialContext
  	}
  	d := connrotation.NewDialer(dial)
  	a.onRotate = d.CloseAll
  	c.Dial = d.DialContext
  
  	return nil
  }
docs: // UpdateTransportConfig updates the transport.Config to use credentials
  // returned by the plugin.