code: func UnmarshalCertRoles(data string) ([]string, error) {
  	var certRoles CertRoles
  	if err := utils.UnmarshalWithSchema(CertRolesSchema, &certRoles, []byte(data)); err != nil {
  		return nil, trace.BadParameter(err.Error())
  	}
  	return certRoles.Roles, nil
  }
docs: // UnmarshalCertRoles marshals roles list to OpenSSH