code: func (gServer *GRPCServer) RemoveClientRootCAs(clientRoots [][]byte) error {
  	gServer.lock.Lock()
  	defer gServer.lock.Unlock()
  	//remove from internal map
  	for _, clientRoot := range clientRoots {
  		err := gServer.removeClientRootCA(clientRoot)
  		if err != nil {
  			return err
  		}
  	}
  
  	//create a new CertPool and populate with current clientRootCAs
  	certPool := x509.NewCertPool()
  	for _, clientRoot := range gServer.clientRootCAs {
  		certPool.AddCert(clientRoot)
  	}
  
  	//replace the current ClientCAs pool
  	gServer.tlsConfig.ClientCAs = certPool
  	return nil
  }
docs: // RemoveClientRootCAs removes PEM-encoded X509 certificate authorities from
  // the list of authorities used to verify client certificates