func createKeyBodyRequest(method, urlStr, filedata string) (*http.Request, error) {
	bodyBuf := &bytes.Buffer{}
	bodyWriter := multipart.NewWriter(bodyBuf)
	fileWriter, err := bodyWriter.CreateFormFile("pubkeyfile", "somefilename.pub")
	if err != nil {
		fmt.Println("error writing to buffer")
		return nil, err
	}
	fh := strings.NewReader(filedata)
	_, err = io.Copy(fileWriter, fh)
	if err != nil {
		return nil, err
	}
	err = bodyWriter.WriteField("duration", (*Duration).String())
	if err != nil {
		return nil, err
	}
	contentType := bodyWriter.FormDataContentType()
	bodyWriter.Close()
	req, err := http.NewRequest(method, urlStr, bodyBuf)
	if err != nil {
		return nil, err
	}
	req.Header.Set("Content-Type", contentType)
	return req, nil
}
This is now copy-paste from the server test side... probably make public and reuse.
package twofa
import (
	"bytes"
	"crypto"
	"crypto/x509"
	"encoding/json"
	"encoding/pem"
	"errors"
	"fmt"
	"io"
	"io/ioutil"
	"mime/multipart"
	"net/http"
	"net/url"
	"os"
	"runtime"
	"strconv"
	"strings"
	"github.com/Symantec/Dominator/lib/log"
	"github.com/Symantec/keymaster/lib/client/twofa/u2f"
	"github.com/Symantec/keymaster/lib/client/twofa/vip"
	"github.com/Symantec/keymaster/lib/webapi/v0/proto"
	"github.com/flynn/u2f/u2fhid"  
	"golang.org/x/crypto/ssh"
)
const clientDataAuthenticationTypeValue = "navigator.id.getAssertion"