code: func (c *ConnectCALeaf) fetchDone(rootUpdateCh chan struct{}) {
  	c.rootWatchMu.Lock()
  	defer c.rootWatchMu.Unlock()
  	delete(c.rootWatchSubscribers, rootUpdateCh)
  	if len(c.rootWatchSubscribers) == 0 && c.rootWatchCancel != nil {
  		// This was the last request. Stop the root watcher.
  		c.rootWatchCancel()
  	}
  }
docs: // fetchDone is called when a blocking call exits to unsubscribe from root
  // updates and possibly stop the shared root watcher if it's no longer needed.
  // Note that typically root CA is still being watched by clients directly and
  // probably by the ProxyConfigManager so it will stay hot in cache for a while,
  // we are just not monitoring it for updates any more.