code: func (s *Server) ExternalCA() *ExternalCA {
  	s.signingMu.Lock()
  	defer s.signingMu.Unlock()
  	return s.externalCA
  }
docs: // ExternalCA returns the current external CA - this is exposed to support unit testing only, and the external CA
  // should really be a private field