code: func (s *server) checkHostCert(logger *log.Entry, user string, clusterName string, cert *ssh.Certificate) error {
  	if cert.CertType != ssh.HostCert {
  		return trace.BadParameter("expected host cert, got wrong cert type: %d", cert.CertType)
  	}
  
  	// fetch keys of the certificate authority to check
  	// if there is a match
  	keys, err := s.getTrustedCAKeysByID(services.CertAuthID{
  		Type:       services.HostCA,
  		DomainName: clusterName,
  	})
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// match key of the certificate authority with the signature key
  	var match bool
  	for _, k := range keys {
  		if sshutils.KeysEqual(k, cert.SignatureKey) {
  			match = true
  			break
  		}
  	}
  	if !match {
  		return trace.NotFound("cluster %v has no matching CA keys", clusterName)
  	}
  
  	checker := utils.CertChecker{}
  	if err := checker.CheckCert(user, cert); err != nil {
  		return trace.BadParameter(err.Error())
  	}
  
  	return nil
  }
docs: // checkHostCert verifies that host certificate is signed
  // by the recognized certificate authority