code: func validateCACertAndKey(l certKeyLocation) error {
  	if err := validateCACert(l); err != nil {
  		return err
  	}
  
  	_, err := pkiutil.TryLoadKeyFromDisk(l.pkiDir, l.caBaseName)
  	if err != nil {
  		return errors.Wrapf(err, "failure loading key for %s", l.uxName)
  	}
  	return nil
  }
docs: // validateCACertAndKey tries to load a x509 certificate and private key from pkiDir,
  // and validates that the cert is a CA