code: func (tc *TeleportClient) getProxySSHPrincipal() string {
  	proxyPrincipal := tc.Config.HostLogin
  	if tc.DefaultPrincipal != "" {
  		proxyPrincipal = tc.DefaultPrincipal
  	}
  	// see if we already have a signed key in the cache, we'll use that instead
  	if !tc.Config.SkipLocalAuth && tc.LocalAgent() != nil {
  		signers, err := tc.LocalAgent().Signers()
  		if err != nil || len(signers) == 0 {
  			return proxyPrincipal
  		}
  		cert, ok := signers[0].PublicKey().(*ssh.Certificate)
  		if ok && len(cert.ValidPrincipals) > 0 {
  			return cert.ValidPrincipals[0]
  		}
  	}
  	return proxyPrincipal
  }
docs: // getProxyLogin determines which SSH principal to use when connecting to proxy.