code: func (c *CertChecker) Authenticate(conn ConnMetadata, pubKey PublicKey) (*Permissions, error) {
  	cert, ok := pubKey.(*Certificate)
  	if !ok {
  		if c.UserKeyFallback != nil {
  			return c.UserKeyFallback(conn, pubKey)
  		}
  		return nil, errors.New("ssh: normal key pairs not accepted")
  	}
  
  	if cert.CertType != UserCert {
  		return nil, fmt.Errorf("ssh: cert has type %d", cert.CertType)
  	}
  
  	if err := c.CheckCert(conn.User(), cert); err != nil {
  		return nil, err
  	}
  
  	return &cert.Permissions, nil
  }
docs: // Authenticate checks a user certificate. Authenticate can be used as
  // a value for ServerConfig.PublicKeyCallback.