code: func (a *LocalKeyAgent) checkHostCertificate(key ssh.PublicKey, addr string) bool {
  	// Check the local cache (where all Teleport CAs are placed upon login) to
  	// see if any of them match.
  	keys, err := a.keyStore.GetKnownHostKeys("")
  	if err != nil {
  		a.log.Errorf("Unable to fetch certificate authorities: %v.", err)
  		return false
  	}
  	for i := range keys {
  		if sshutils.KeysEqual(key, keys[i]) {
  			return true
  		}
  	}
  
  	// If this certificate was not seen before, prompt the user essentially
  	// treating it like a key.
  	err = a.checkHostKey(addr, nil, key)
  	if err != nil {
  		return false
  	}
  	return true
  }
docs: // checkHostCertificate validates a host certificate. First checks the
  // ~/.tsh/known_hosts cache and if not found, prompts the user to accept
  // or reject.