code: func userCAFormat(ca services.CertAuthority, keyBytes []byte) (string, error) {
  	return sshutils.MarshalAuthorizedKeysFormat(ca.GetClusterName(), keyBytes)
  }
docs: // userCAFormat returns the certificate authority public key exported as a single
  // line that can be placed in ~/.ssh/authorized_keys file. The format adheres to the
  // man sshd (8) authorized_keys format, a space-separated list of: options, keytype,
  // base64-encoded key, comment.
  // For example:
  //
  //    cert-authority AAA... type=user&clustername=cluster-a
  //
  // URL encoding is used to pass the CA type and cluster name into the comment field.