code: func hasSigningKey(a interface{}) bool {
  	switch b := a.(type) {
  	case *api.RootCA:
  		return len(b.CAKey) > 0
  	case *api.RootRotation:
  		return b != nil && len(b.CAKey) > 0
  	case *api.CAConfig:
  		return len(b.SigningCACert) > 0 && len(b.SigningCAKey) > 0
  	default:
  		panic("needsExternalCAs should be called something of type *api.RootCA, *api.RootRotation, or *api.CAConfig")
  	}
  }
docs: // determines whether an api.RootCA, api.RootRotation, or api.CAConfig has a signing key (local signer)