code: func DownloadRootCA(ctx context.Context, paths CertPaths, token string, connBroker *connectionbroker.Broker) (RootCA, error) {
  	var rootCA RootCA
  	// Get a digest for the optional CA hash string that we've been provided
  	// If we were provided a non-empty string, and it is an invalid hash, return
  	// otherwise, allow the invalid digest through.
  	var (
  		d   digest.Digest
  		err error
  	)
  	if token != "" {
  		parsed, err := ParseJoinToken(token)
  		if err != nil {
  			return RootCA{}, err
  		}
  		d = parsed.RootDigest
  	}
  	// Get the remote CA certificate, verify integrity with the
  	// hash provided. Retry up to 5 times, in case the manager we
  	// first try to contact is not responding properly (it may have
  	// just been demoted, for example).
  
  	for i := 0; i != 5; i++ {
  		rootCA, err = GetRemoteCA(ctx, d, connBroker)
  		if err == nil {
  			break
  		}
  		log.G(ctx).WithError(err).Errorf("failed to retrieve remote root CA certificate")
  
  		select {
  		case <-time.After(GetCertRetryInterval):
  		case <-ctx.Done():
  			return RootCA{}, ctx.Err()
  		}
  	}
  	if err != nil {
  		return RootCA{}, err
  	}
  
  	// Save root CA certificate to disk
  	if err = SaveRootCA(rootCA, paths); err != nil {
  		return RootCA{}, err
  	}
  
  	log.G(ctx).Debugf("retrieved remote CA certificate: %s", paths.Cert)
  	return rootCA, nil
  }
docs: // DownloadRootCA tries to retrieve a remote root CA and matches the digest against the provided token.