code: func (a *AuthWithRoles) GenerateServerKeys(req GenerateServerKeysRequest) (*PackedKeys, error) {
  	clusterName, err := a.authServer.GetDomainName()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	// username is hostID + cluster name, so make sure server requests new keys for itself
  	if a.user.GetName() != HostFQDN(req.HostID, clusterName) {
  		return nil, trace.AccessDenied("username mismatch %q and %q", a.user.GetName(), HostFQDN(req.HostID, clusterName))
  	}
  	existingRoles, err := teleport.NewRoles(a.user.GetRoles())
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	// prohibit privilege escalations through role changes
  	if !existingRoles.Equals(req.Roles) {
  		return nil, trace.AccessDenied("roles do not match: %v and %v", existingRoles, req.Roles)
  	}
  	return a.authServer.GenerateServerKeys(req)
  }
docs: // GenerateServerKeys generates new host private keys and certificates (signed
  // by the host certificate authority) for a node.