code: func (s *Server) RootCA() *RootCA {
  	s.signingMu.Lock()
  	defer s.signingMu.Unlock()
  	return s.localRootCA
  }
docs: // RootCA returns the current local root CA - this is exposed to support unit testing only, and the root CA
  // should really be a private field