public function getGitkitCerts() {
    $certUrl = $this->gitkitApisUrl . 'publicKeys';
    if ($this->apiKey) {
      // try server-key first
      return $this->oauth2Client->retrieveCertsFromLocation(
          $certUrl . '?key=' . $this->apiKey);
    } else {
      // fallback to service account
      $httpRequest = new Google_Http_Request($certUrl);
      $response = $this->oauth2Client->authenticatedRequest($httpRequest)
          ->getResponseBody();
      return json_decode($response);
    }
  }