// verify workload cert contains the correct intermediate cert
	if !bytes.Equal(workloadX509.AuthorityKeyId, caX590.SubjectKeyId) {
		return fmt.Errorf("workload certificate did not have expected authority key id: got %v wanted %v",
			string(workloadX509.AuthorityKeyId), string(caX590.SubjectKeyId))
	}

	return nil
}

func getX509FromFile(t framework.TestContext, caCertFile string) *x509.Certificate {