code: func (a *AuthCommand) GenerateAndSignKeys(clusterApi auth.ClientI) error {
  	switch {
  	case a.genUser != "" && a.genHost == "":
  		return a.generateUserKeys(clusterApi)
  	case a.genUser == "" && a.genHost != "":
  		return a.generateHostKeys(clusterApi)
  	default:
  		return trace.BadParameter("--user or --host must be specified")
  	}
  }
docs: // GenerateAndSignKeys generates a new keypair and signs it for role