code: func validateHostSigner(signer ssh.Signer) error {
  	cert, ok := signer.PublicKey().(*ssh.Certificate)
  	if !ok {
  		return trace.BadParameter("only host certificates supported")
  	}
  	if len(cert.ValidPrincipals) == 0 {
  		return trace.BadParameter("at least one valid principal is required in host certificate")
  	}
  
  	certChecker := utils.CertChecker{}
  	err := certChecker.CheckCert(cert.ValidPrincipals[0], cert)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	return nil
  }
docs: // validateHostSigner make sure the signer is a valid certificate.