code: func (i *Identity) hostKeyCallback(hostname string, remote net.Addr, key ssh.PublicKey) error {
  	cert, ok := key.(*ssh.Certificate)
  	if !ok {
  		return trace.BadParameter("only host certificates supported")
  	}
  
  	// Loop over all CAs and see if any of them signed the certificate.
  	for _, k := range i.SSHCACertBytes {
  		pubkey, _, _, _, err := ssh.ParseAuthorizedKey(k)
  		if err != nil {
  			return trace.Wrap(err)
  		}
  		if sshutils.KeysEqual(cert.SignatureKey, pubkey) {
  			return nil
  		}
  	}
  
  	return trace.BadParameter("no matching keys found")
  }
docs: // hostKeyCallback checks if the host certificate was signed by any of the
  // known CAs.