code: func hostCAFormat(ca services.CertAuthority, keyBytes []byte, client auth.ClientI) (string, error) {
  	roles, err := services.FetchRoles(ca.GetRoles(), client, nil)
  	if err != nil {
  		return "", trace.Wrap(err)
  	}
  	allowedLogins, _ := roles.CheckLoginDuration(defaults.MinCertDuration + time.Second)
  	return sshutils.MarshalAuthorizedHostsFormat(ca.GetClusterName(), keyBytes, allowedLogins)
  }
docs: // hostCAFormat returns the certificate authority public key exported as a single line
  // that can be placed in ~/.ssh/authorized_hosts. The format adheres to the man sshd (8)
  // authorized_hosts format, a space-separated list of: marker, hosts, key, and comment.
  // For example:
  //
  //    @cert-authority *.cluster-a ssh-rsa AAA... type=host
  //
  // URL encoding is used to pass the CA type and allowed logins into the comment field.