code: func parseKnownHosts(bytes []byte, allowedLogins []string) (services.CertAuthority, services.Role, error) {
  	marker, options, pubKey, comment, _, err := ssh.ParseKnownHosts(bytes)
  	if marker != "cert-authority" {
  		return nil, nil, trace.BadParameter("invalid file format. expected '@cert-authority` marker")
  	}
  	if err != nil {
  		return nil, nil, trace.BadParameter("invalid public key")
  	}
  	teleportOpts, err := url.ParseQuery(comment)
  	if err != nil {
  		return nil, nil, trace.BadParameter("invalid key comment: '%s'", comment)
  	}
  	authType := services.CertAuthType(teleportOpts.Get("type"))
  	if authType != services.HostCA && authType != services.UserCA {
  		return nil, nil, trace.BadParameter("unsupported CA type: '%s'", authType)
  	}
  	if len(options) == 0 {
  		return nil, nil, trace.BadParameter("key without cluster_name")
  	}
  	const prefix = "*."
  	domainName := strings.TrimPrefix(options[0], prefix)
  
  	v1 := &services.CertAuthorityV1{
  		AllowedLogins: utils.CopyStrings(allowedLogins),
  		DomainName:    domainName,
  		Type:          authType,
  		CheckingKeys:  [][]byte{ssh.MarshalAuthorizedKey(pubKey)},
  	}
  	ca, role := services.ConvertV1CertAuthority(v1)
  	return ca, role, nil
  }
docs: // parseKnownHosts parses keys in known_hosts format and returns a
  // services.CertAuthority.