code: func (s *CA) CompareAndSwapCertAuthority(new, existing services.CertAuthority) error {
  	if err := new.Check(); err != nil {
  		return trace.Wrap(err)
  	}
  	newValue, err := services.GetCertAuthorityMarshaler().MarshalCertAuthority(new)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	newItem := backend.Item{
  		Key:     backend.Key(authoritiesPrefix, string(new.GetType()), new.GetName()),
  		Value:   newValue,
  		Expires: new.Expiry(),
  	}
  
  	existingValue, err := services.GetCertAuthorityMarshaler().MarshalCertAuthority(existing)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	existingItem := backend.Item{
  		Key:     backend.Key(authoritiesPrefix, string(existing.GetType()), existing.GetName()),
  		Value:   existingValue,
  		Expires: existing.Expiry(),
  	}
  
  	_, err = s.CompareAndSwap(context.TODO(), existingItem, newItem)
  	if err != nil {
  		if trace.IsCompareFailed(err) {
  			return trace.CompareFailed("cluster %v settings have been updated, try again", new.GetName())
  		}
  		return trace.Wrap(err)
  	}
  	return nil
  }
docs: // CompareAndSwapCertAuthority updates the cert authority value
  // if the existing value matches existing parameter, returns nil if succeeds,
  // trace.CompareFailed otherwise.