code: func (tc *TeleportClient) UpdateTrustedCA(ctx context.Context, clusterName string) error {
  	// Get the list of host certificates that this cluster knows about.
  	hostCerts, err := tc.GetTrustedCA(ctx, clusterName)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	trustedCerts := auth.AuthoritiesToTrustedCerts(hostCerts)
  
  	// Update the ~/.tsh/known_hosts file to include all the CA the cluster
  	// knows about.
  	err = tc.localAgent.AddHostSignersToCache(trustedCerts)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	// Update the CA pool with all the CA the cluster knows about.
  	err = tc.localAgent.SaveCerts(trustedCerts)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  
  	return nil
  }
docs: // UpdateTrustedCA connects to the Auth Server and fetches all host certificates
  // and updates ~/.tsh/keys/proxy/certs.pem and ~/.tsh/known_hosts.