code: func updateClients(ca services.CertAuthority, mode string) error {
  	rotation := ca.GetRotation()
  
  	signingKeys := ca.GetSigningKeys()
  	checkingKeys := ca.GetCheckingKeys()
  	keyPairs := ca.GetTLSKeyPairs()
  
  	signingKeys = [][]byte{signingKeys[1], signingKeys[0]}
  	checkingKeys = [][]byte{checkingKeys[1], checkingKeys[0]}
  
  	keyPairs = []services.TLSKeyPair{keyPairs[1], keyPairs[0]}
  	rotation.State = services.RotationStateInProgress
  	rotation.Phase = services.RotationPhaseUpdateClients
  	rotation.Mode = mode
  
  	ca.SetSigningKeys(signingKeys)
  	ca.SetCheckingKeys(checkingKeys)
  	ca.SetTLSKeyPairs(keyPairs)
  	ca.SetRotation(rotation)
  	return nil
  }
docs: // updateClients swaps old and new cert authorities:
  //
  // * old CAs exist and are trusted, but are not used for signing
  // * the new CAs are now used for signing
  // * remote components will reload with new certificates used for client connections
  //