code: func (s *InstanceSecrets) GetCAs() []services.CertAuthority {
  	hostCA := services.NewCertAuthority(services.HostCA, s.SiteName, [][]byte{s.PrivKey}, [][]byte{s.PubKey}, []string{})
  	hostCA.SetTLSKeyPairs([]services.TLSKeyPair{{Cert: s.TLSCACert, Key: s.PrivKey}})
  	return []services.CertAuthority{
  		hostCA,
  		services.NewCertAuthority(services.UserCA, s.SiteName, [][]byte{s.PrivKey}, [][]byte{s.PubKey}, []string{services.RoleNameForCertAuthority(s.SiteName)}),
  	}
  }
docs: // GetCAs return an array of CAs stored by the secrets object. In i
  // case we always return hard-coded userCA + hostCA (and they share keys
  // for simplicity)