How to use the rsa.PublicKey.load_pkcs1 function in rsa

# this is the ballot to verify
ballot = """
{{=XML(ballot.ballot_content)}}
""".strip()

# this is the ballot RSA signature
signature = base64.b16decode("{{=ballot.signature.split('-')[1]}}")

# this is the election public key
pk_pem = """
{{=election.public_key.strip()}}
"""

# this is the code that verifies the signature
public_key = rsa.PublicKey.load_pkcs1(pk_pem)
if rsa.verify(ballot, signature, public_key):
    print 'valid'
else:
    print 'invalid'

my_prvkey_pem = my_pubkey_pem = auditor_pubkey_pem = ''
        if os.path.exists(join(data_dir, 'recentkeys')):
            if os.path.exists(join(data_dir, 'recentkeys', 'myprivkey')) and os.path.exists(join(data_dir, 'recentkeys', 'mypubkey')):
                with open(join(data_dir, 'recentkeys', 'myprivkey'), 'rb') as f: my_prvkey_pem = f.read()
                with open(join(data_dir, 'recentkeys', 'mypubkey'), 'rb') as f: my_pubkey_pem = f.read()
                with open(join(current_session_dir, 'myprivkey'), 'wb') as f: f.write(my_prvkey_pem)
                with open(join(current_session_dir, 'mypubkey'), 'wb') as f: f.write(my_pubkey_pem)
                global my_prv_key                    
                my_prv_key = rsa.PrivateKey.load_pkcs1(my_prvkey_pem)
            if os.path.exists(join(data_dir, 'recentkeys', 'auditorpubkey')):
                with open(join(data_dir, 'recentkeys', 'auditorpubkey'), 'rb') as f: auditor_pubkey_pem = f.read()
                with open(join(current_session_dir, 'auditorpubkey'), 'wb') as f: f.write(auditor_pubkey_pem)
                global auditor_pub_key                    
                auditor_pub_key = rsa.PublicKey.load_pkcs1(auditor_pubkey_pem)
            global my_pub_key
            my_pub_key = rsa.PublicKey.load_pkcs1(my_pubkey_pem)
            my_pubkey_export = b64encode(shared.bi2ba(my_pub_key.n))
            if auditor_pubkey_pem == '': auditor_pubkey_export = ''
            else: auditor_pubkey_export = b64encode(shared.bi2ba(auditor_pub_key.n))
            self.respond({'response':'get_recent_keys', 'mypubkey':my_pubkey_export,
                     'auditorpubkey':auditor_pubkey_export})
        else:
            self.respond({'response':'get_recent_keys', 'mypubkey':'', 'auditorpubkey':''})                
        return

#If this is the very first time tlsnotary is run, there will be no saved keys
    #otherwise we load up the saved keys which the user can override with new keys if need be
    my_pubkey_export = auditee_pubkey_export = ''
    if os.path.exists(os.path.join(datadir, 'recentkeys')):
        if os.path.exists(os.path.join(datadir, 'recentkeys', 'myprivkey')) and os.path.exists(os.path.join(datadir, 'recentkeys', 'mypubkey')):
            with open(os.path.join(datadir, 'recentkeys', 'myprivkey'), 'r') as f: my_privkey_pem = f.read()
            with open(os.path.join(datadir, 'recentkeys', 'mypubkey'), 'r') as f: my_pubkey_pem = f.read()
            with open(os.path.join(current_sessiondir, 'myprivkey'), 'w') as f: f.write(my_privkey_pem)
            with open(os.path.join(current_sessiondir, 'mypubkey'), 'w') as f: f.write(my_pubkey_pem)
            my_private_key = rsa.PrivateKey.load_pkcs1(my_privkey_pem)
            my_pub_key = rsa.PublicKey.load_pkcs1(my_pubkey_pem)
            my_pubkey_export = base64.b64encode(shared.bi2ba(my_pub_key.n))
        if os.path.exists(os.path.join(datadir, 'recentkeys', 'auditeepubkey')):
            with open(os.path.join(datadir, 'recentkeys', 'auditeepubkey'), 'r') as f: auditee_pubkey_pem = f.read()
            with open(os.path.join(current_sessiondir, 'auditorpubkey'), 'w') as f: f.write(auditee_pubkey_pem)
            auditee_public_key = rsa.PublicKey.load_pkcs1(auditee_pubkey_pem)
            auditee_pubkey = rsa.PublicKey.load_pkcs1(auditee_pubkey_pem)
            auditee_pubkey_export = base64.b64encode(shared.bi2ba(auditee_pubkey.n))
    return my_pubkey_export, auditee_pubkey_export

if flavor not in conf:
            raise exceptions.ConfigError(
                'The specified flavor (%s) is missing in your config file (%s)'
                % (flavor, config_path))
        conf = conf[flavor]
        conf.flavor = flavor

    if conf.privileged_key:
        try:
            f = open(conf.privileged_key)
        except Exception:
            raise exceptions.FileNotFoundError(
                'Heads-up! File is missing: %s' % conf.privileged_key)

        try:
            conf.privileged_key = rsa.PublicKey.load_pkcs1(f.read())
        except Exception:
            raise exceptions.ConfigError(
                'Key at %s is not a valid RSA key' % conf.privileged_key)

    if conf.index_endpoint:
        conf.index_endpoint = conf.index_endpoint.strip('/')

    return conf

def read_pubkey(self):
        with open(self.admin_pubkey_path, 'rb') as f:
            admin_pubkey = rsa.PublicKey.load_pkcs1(f.read())
        return admin_pubkey

rsa_private_filepath = click.prompt("RSA authentication private key filepath", type=str, default="./private.pem")
        with open(rsa_private_filepath, "rb") as f:
            rsa_private_filepath = os.path.realpath(f.name)
            data = f.read()
        try:
            rsa.PrivateKey.load_pkcs1(data)
        except:
            raise ValueError("Invalid Private Key File")

        # get private key
        rsa_public_filepath = click.prompt("RSA authentication public key filepath", type=str, default="./public.pem")
        with open(rsa_public_filepath, "rb") as f:
            rsa_public_filepath = os.path.realpath(f.name)
            data = f.read()
        try:
            rsa.PublicKey.load_pkcs1(data)
        except:
            raise ValueError("Invalid Public Key File")

    # if they don't have an RSA key, make one
    else:
        print("Now generating RSA authentication key for hub. This will allow your hub to prove its identity to the MechWolf resolver. This step may take a few seconds.")
        public, private = rsa.newkeys(2048)

        with open("public.pem", "wb+") as f:
            f.write(public.save_pkcs1())
            rsa_public_filepath = os.path.realpath(f.name)

        with open("private.pem", "wb+") as f:
            f.write(private.save_pkcs1())
            rsa_private_filepath = os.path.realpath(f.name)

def get_recent_keys():
    global my_private_key
    global auditee_public_key
    global my_pub_key
    #this is the very first command that we expect in a new session.
    #If this is the very first time tlsnotary is run, there will be no saved keys
    #otherwise we load up the saved keys which the user can override with new keys if need be
    my_pubkey_export = auditee_pubkey_export = ''
    if os.path.exists(os.path.join(datadir, 'recentkeys')):
        if os.path.exists(os.path.join(datadir, 'recentkeys', 'myprivkey')) and os.path.exists(os.path.join(datadir, 'recentkeys', 'mypubkey')):
            with open(os.path.join(datadir, 'recentkeys', 'myprivkey'), 'r') as f: my_privkey_pem = f.read()
            with open(os.path.join(datadir, 'recentkeys', 'mypubkey'), 'r') as f: my_pubkey_pem = f.read()
            with open(os.path.join(current_sessiondir, 'myprivkey'), 'w') as f: f.write(my_privkey_pem)
            with open(os.path.join(current_sessiondir, 'mypubkey'), 'w') as f: f.write(my_pubkey_pem)
            my_private_key = rsa.PrivateKey.load_pkcs1(my_privkey_pem)
            my_pub_key = rsa.PublicKey.load_pkcs1(my_pubkey_pem)
            my_pubkey_export = base64.b64encode(shared.bi2ba(my_pub_key.n))
        if os.path.exists(os.path.join(datadir, 'recentkeys', 'auditeepubkey')):
            with open(os.path.join(datadir, 'recentkeys', 'auditeepubkey'), 'r') as f: auditee_pubkey_pem = f.read()
            with open(os.path.join(current_sessiondir, 'auditorpubkey'), 'w') as f: f.write(auditee_pubkey_pem)
            auditee_public_key = rsa.PublicKey.load_pkcs1(auditee_pubkey_pem)
            auditee_pubkey = rsa.PublicKey.load_pkcs1(auditee_pubkey_pem)
            auditee_pubkey_export = base64.b64encode(shared.bi2ba(auditee_pubkey.n))
    return my_pubkey_export, auditee_pubkey_export

ValueError: if the key_pem can't be parsed. In either case, error
                        will begin with 'No PEM start marker'. If
                        ``is_x509_cert`` is True, will fail to find the
                        "-----BEGIN CERTIFICATE-----" error, otherwise fails
                        to find "-----BEGIN RSA PUBLIC KEY-----".
        """
        key_pem = _helpers._to_bytes(key_pem)
        if is_x509_cert:
            der = rsa.pem.load_pem(key_pem, 'CERTIFICATE')
            asn1_cert, remaining = decoder.decode(der, asn1Spec=Certificate())
            if remaining != b'':
                raise ValueError('Unused bytes', remaining)

            cert_info = asn1_cert['tbsCertificate']['subjectPublicKeyInfo']
            key_bytes = _bit_list_to_bytes(cert_info['subjectPublicKey'])
            pubkey = rsa.PublicKey.load_pkcs1(key_bytes, 'DER')
        else:
            pubkey = rsa.PublicKey.load_pkcs1(key_pem, 'PEM')
        return cls(pubkey)