code: func (h *AuthHandlers) authorityForCert(caType services.CertAuthType, key ssh.PublicKey) (services.CertAuthority, error) {
  	// get all certificate authorities for given type
  	cas, err := h.AccessPoint.GetCertAuthorities(caType, false)
  	if err != nil {
  		h.Warnf("%v", trace.DebugReport(err))
  		return nil, trace.Wrap(err)
  	}
  
  	// find the one that signed our certificate
  	var ca services.CertAuthority
  	for i := range cas {
  		checkers, err := cas[i].Checkers()
  		if err != nil {
  			h.Warnf("%v", err)
  			return nil, trace.Wrap(err)
  		}
  		for _, checker := range checkers {
  			// if we have a certificate, compare the certificate signing key against
  			// the ca key. otherwise check the public key that was passed in. this is
  			// due to the differences in how this function is called by the user and
  			// host checkers.
  			switch v := key.(type) {
  			case *ssh.Certificate:
  				if sshutils.KeysEqual(v.SignatureKey, checker) {
  					ca = cas[i]
  					break
  				}
  			default:
  				if sshutils.KeysEqual(key, checker) {
  					ca = cas[i]
  					break
  				}
  			}
  		}
  	}
  
  	// the certificate was signed by unknown authority
  	if ca == nil {
  		return nil, trace.AccessDenied("the certificate signed by untrusted CA")
  	}
  
  	return ca, nil
  }
docs: // authorityForCert checks if the certificate was signed by a Teleport
  // Certificate Authority and returns it.