code: func (s *server) isUserAuthority(auth ssh.PublicKey) bool {
  	keys, err := s.getTrustedCAKeys(services.UserCA)
  	if err != nil {
  		s.Errorf("failed to retrieve trusted keys, err: %v", err)
  		return false
  	}
  	for _, k := range keys {
  		if sshutils.KeysEqual(k, auth) {
  			return true
  		}
  	}
  	return false
  }
docs: // isUserAuthority is called during checking the client key, to see if the signing
  // key is the real user CA authority key.