x509.Decrypt(Encrypt)PEMBlock deprecated starting go1.16

```
has been deprecated since Go 1.16 because it shouldn't be used: Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.
```

https://github.com/golang/go/issues/41949

should start using `PKCS8` ?