cautils.loadJWK calls jose.Decrypt, which calls jose.JSONWebEncryption.Decrypt

actions.updatePolicy calls ca.AdminClient.UpdateAuthorityPolicy, which eventually calls json.Decoder.Peek

actions.updatePolicy calls ca.AdminClient.UpdateAuthorityPolicy, which eventually calls json.Decoder.Read

actions.updatePolicy calls ca.AdminClient.UpdateAuthorityPolicy, which eventually calls protojson.Unmarshal

exec.Step calls exec.Cmd.Start, which eventually calls pgproto3.Bind.Encode

exec.Step calls exec.Cmd.Start, which eventually calls pgproto3.Describe.Encode

exec.Step calls exec.Cmd.Start, which eventually calls pgproto3.Execute.Encode

cautils.NewOfflineCA calls authority.New, which eventually calls pgproto3.GSSResponse.Encode

exec.Step calls exec.Cmd.Start, which eventually calls pgproto3.Parse.Encode

cautils.NewOfflineCA calls authority.New, which eventually calls pgproto3.PasswordMessage.Encode

unslice: could simplify out[:] to out (gocritic)

SA1019: "golang.org/x/crypto/blowfish" is deprecated: any new system should use AES (from crypto/aes, if necessary in an AEAD mode like crypto/cipher.NewGCM) or XChaCha20-Poly1305 (from golang.org/x/crypto/chacha20poly1305). (staticcheck)

ST1003: should not use underscores in package names (stylecheck)

issues found