code: func (s *server) isHostAuthority(auth ssh.PublicKey, address string) bool {
  	keys, err := s.getTrustedCAKeys(services.HostCA)
  	if err != nil {
  		s.Errorf("failed to retrieve trusted keys, err: %v", err)
  		return false
  	}
  	for _, k := range keys {
  		if sshutils.KeysEqual(k, auth) {
  			return true
  		}
  	}
  	return false
  }
docs: // isHostAuthority is called during checking the client key, to see if the signing
  // key is the real host CA authority key.