code: func (h *AuthHandlers) HostKeyAuth(addr string, remote net.Addr, key ssh.PublicKey) error {
  	fingerprint := fmt.Sprintf("%v %v", key.Type(), sshutils.Fingerprint(key))
  
  	// update entry to include a fingerprint of the key so admins can track down
  	// the key causing problems
  	h.Entry = log.WithFields(log.Fields{
  		trace.Component: h.Component,
  		trace.ComponentFields: log.Fields{
  			"remote":      remote.String(),
  			"fingerprint": fingerprint,
  		},
  	})
  
  	// Check if the given host key was signed by a Teleport certificate
  	// authority (CA) or fallback to host key checking if it's allowed.
  	certChecker := utils.CertChecker{
  		CertChecker: ssh.CertChecker{
  			IsHostAuthority: h.IsHostAuthority,
  			HostKeyFallback: h.hostKeyCallback,
  		},
  	}
  	err := certChecker.CheckHostKey(addr, remote, key)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	return nil
  }
docs: // HostKeyAuth implements host key verification and is called by the client
  // to validate the certificate presented by the target server. If the target
  // server presents a SSH certificate, we validate that it was Teleport that
  // generated the certificate. If the target server presents a public key, if
  // we are strictly checking keys, we reject the target server. If we are not
  // we take whatever.