code: func validateCAConfigs(ctx *validation.Context, cfg *admin.TokenServerConfig, idToCN map[int64]string) {
  	seenIDs := make(map[int64]string, len(idToCN))
  	for k, v := range idToCN {
  		seenIDs[k] = v
  	}
  	seenCAs := stringset.New(len(cfg.CertificateAuthority))
  	for _, ca := range cfg.CertificateAuthority {
  		ctx.Enter("CA %q", ca.Cn)
  		if seenCAs.Has(ca.Cn) {
  			ctx.Errorf("duplicate CA entries in the config")
  		} else {
  			seenCAs.Add(ca.Cn)
  		}
  		// Check unique ID is not being reused.
  		if existing, seen := seenIDs[ca.UniqueId]; seen {
  			if existing != ca.Cn {
  				ctx.Errorf("unique_id %d has already been used for CA %q and can't be reused, pick another one",
  					ca.UniqueId, existing)
  			}
  		} else {
  			seenIDs[ca.UniqueId] = ca.Cn
  		}
  		ctx.Exit()
  	}
  }
docs: // validateCAConfigs checks correctness of CertificateAuthorityConfig messages.
  //
  // Mapping from unique_id to a cert should be unique in time, so this function
  // also accepts an existing mapping (fetched from the datastore), to verify
  // no IDs are reused.