gserviceaccount/gserviceaccount.go
func (gsa *GServiceAccount) Signer() (jwt.Signer, error) {
	gsa.mu.Lock()
	defer gsa.mu.Unlock()

	if gsa.signer == nil {
		keyset, err := pemutil.DecodeBytes([]byte(gsa.PrivateKey))
		if err != nil {
			return nil, fmt.Errorf("jwt/gserviceaccount: could not decode private key: %v", err)
		}
		keyset.AddPublicKeys()

		s, err := DefaultAlgorithm.New(keyset)
		if err != nil {
			return nil, err
		}
		gsa.signer = s
	}

	return gsa.signer, nil
}
func (gsa *GServiceAccount) Signer() (jwt.Signer, error) {
	gsa.mu.Lock()
	defer gsa.mu.Unlock()

	if gsa.signer == nil {
		keyset, err := pemutil.DecodeBytes([]byte(gsa.PrivateKey))
		if err != nil {
			return nil, fmt.Errorf("jwt/gserviceaccount: could not decode private key: %v", err)
		}
		keyset.AddPublicKeys()

		s, err := DefaultAlgorithm.New(keyset)
		if err != nil {
			return nil, err
		}
		gsa.signer = s
	}

	return gsa.signer, nil
}
// Signer returns a jwt.Signer for use when signing tokens.