code: func startRollingBackRotation(ca services.CertAuthority) error {
  	rotation := ca.GetRotation()
  
  	// Rollback always sets rotation to manual mode.
  	rotation.Mode = services.RotationModeManual
  
  	signingKeys := ca.GetSigningKeys()
  	checkingKeys := ca.GetCheckingKeys()
  	keyPairs := ca.GetTLSKeyPairs()
  
  	// Rotation sets the first key to be the new key
  	// and keep only public keys/certs for the new CA.
  	signingKeys = [][]byte{signingKeys[1]}
  	checkingKeys = [][]byte{checkingKeys[1]}
  
  	// Keep the new certificate as trusted
  	// as during the rollback phase, both types of clients may be present in the cluster.
  	keyPairs = []services.TLSKeyPair{keyPairs[1], services.TLSKeyPair{Cert: keyPairs[0].Cert}}
  	rotation.State = services.RotationStateInProgress
  	rotation.Phase = services.RotationPhaseRollback
  
  	ca.SetSigningKeys(signingKeys)
  	ca.SetCheckingKeys(checkingKeys)
  	ca.SetTLSKeyPairs(keyPairs)
  	ca.SetRotation(rotation)
  	return nil
  }
docs: // startRollingBackRotation starts roll back to the original state.