code: func (h *AuthHandlers) hostKeyCallback(hostname string, remote net.Addr, key ssh.PublicKey) error {
  	// If strict host key checking is enabled, reject host key fallback.
  	clusterConfig, err := h.AccessPoint.GetClusterConfig()
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	if clusterConfig.GetProxyChecksHostKeys() == services.HostKeyCheckYes {
  		return trace.AccessDenied("remote host presented a public key, expected a host certificate")
  	}
  
  	// If strict host key checking is not enabled, log that Teleport trusted an
  	// insecure key, but allow the request to go through.
  	h.Warn("Insecure configuration! Strict host key checking disabled, allowing login without checking host key of type %v.", key.Type())
  	return nil
  }
docs: // hostKeyCallback allows connections to hosts that present keys only if
  // strict host key checking is disabled.