pub fn pem_encode(label: &str, der: &[u8]) -> String
Encode DER bytes as PEM with the given label (e.g. “RSA PUBLIC KEY”).