code: func getNormalizedExtCAs(caConfig *api.CAConfig, normalizedCurrentRootCACert []byte) (map[string][]*api.ExternalCA, error) {
  	extCAs := make(map[string][]*api.ExternalCA)
  
  	for _, extCA := range caConfig.ExternalCAs {
  		associatedCert := normalizedCurrentRootCACert
  		// if no associated cert is provided, assume it's the current root cert
  		if len(extCA.CACert) > 0 {
  			associatedCert = ca.NormalizePEMs(extCA.CACert)
  		}
  		certKey := string(associatedCert)
  		extCAs[certKey] = append(extCAs[certKey], extCA)
  	}
  
  	return extCAs, nil
  }
docs: // validates that the list of external CAs have valid certs associated with them, and produce a mapping of subject/pubkey:external
  // for later validation of required external CAs