code: func (a *LocalKeyAgent) checkHostKey(addr string, remote net.Addr, key ssh.PublicKey) error {
  	var err error
  
  	// Check if this exact host is in the local cache.
  	keys, _ := a.keyStore.GetKnownHostKeys(addr)
  	if len(keys) > 0 && sshutils.KeysEqual(key, keys[0]) {
  		a.log.Debugf("Verified host %s.", addr)
  		return nil
  	}
  
  	// If this key was not seen before, prompt the user with a fingerprint.
  	if a.hostPromptFunc != nil {
  		err = a.hostPromptFunc(addr, key)
  	} else {
  		err = a.defaultHostPromptFunc(addr, key, os.Stdout, os.Stdin)
  	}
  	if err != nil {
  		a.noHosts[addr] = true
  		return trace.Wrap(err)
  	}
  
  	// If the user trusts the key, store the key in the local known hosts
  	// cache ~/.tsh/known_hosts.
  	err = a.keyStore.AddKnownHostKeys(addr, []ssh.PublicKey{key})
  	if err != nil {
  		a.log.Warnf("Failed to save the host key: %v.", err)
  		return trace.Wrap(err)
  	}
  	return nil
  }
docs: // checkHostKey validates a host key. First checks the
  // ~/.tsh/known_hosts cache and if not found, prompts the user to accept
  // or reject.