func (r *keyring) Unlock(passphrase []byte) error {
	r.mu.Lock()
	defer r.mu.Unlock()
	if !r.locked {
		return errors.New("agent: not locked")
	}
	if len(passphrase) != len(r.passphrase) || 1 != subtle.ConstantTimeCompare(passphrase, r.passphrase) {
		return fmt.Errorf("agent: incorrect passphrase")
	}
	r.locked = false
	r.passphrase = nil
	return nil
}
Unlock undoes the effect of Lock
package agent
import (
	"bytes"
	"crypto/rand"
	"crypto/subtle"
	"errors"
	"fmt"
	"sync"
	"time"
	"golang.org/x/crypto/ssh"
)
type privKey struct {
	signer  ssh.Signer
	comment string
	expire  *time.Time
}
type keyring struct {
	mu   sync.Mutex
	keys []privKey
	locked     bool
	passphrase []byte
}
var errLocked = errors.New("agent: locked")
func NewKeyring() Agent {
	return &keyring{}
}
func (r *keyring) RemoveAll() error {
	r.mu.Lock()
	defer r.mu.Unlock()
	if r.locked {
		return errLocked
	}
	r.keys = nil
	return nil
}
func (r *keyring) removeLocked(want []byte) error {
	found := false
	for i := 0; i < len(r.keys); {
		if bytes.Equal(r.keys[i].signer.PublicKey().Marshal(), want) {
			found = true
			r.keys[i] = r.keys[len(r.keys)-1]
			r.keys = r.keys[:len(r.keys)-1]
			continue
		} else {
			i++
		}
	}
	if !found {
		return errors.New("agent: key not found")
	}
	return nil
}
func (r *keyring) Remove(key ssh.PublicKey) error {
	r.mu.Lock()
	defer r.mu.Unlock()
	if r.locked {
		return errLocked
	}
	return r.removeLocked(key.Marshal())
}
func (r *keyring) Lock(passphrase []byte) error {
	r.mu.Lock()
	defer r.mu.Unlock()
	if r.locked {
		return errLocked
	}
	r.locked = true
	r.passphrase = passphrase
	return nil
}