code: func (a *LocalKeyAgent) AddHostSignersToCache(certAuthorities []auth.TrustedCerts) error {
  	for _, ca := range certAuthorities {
  		publicKeys, err := ca.SSHCertPublicKeys()
  		if err != nil {
  			a.log.Error(err)
  			return trace.Wrap(err)
  		}
  		a.log.Debugf("Adding CA key for %s", ca.ClusterName)
  		err = a.keyStore.AddKnownHostKeys(ca.ClusterName, publicKeys)
  		if err != nil {
  			return trace.Wrap(err)
  		}
  	}
  	return nil
  }
docs: // AddHostSignersToCache takes a list of CAs whom we trust. This list is added to a database
  // of "seen" CAs.
  //
  // Every time we connect to a new host, we'll request its certificaate to be signed by one
  // of these trusted CAs.
  //
  // Why do we trust these CAs? Because we received them from a trusted Teleport Proxy.
  // Why do we trust the proxy? Because we've connected to it via HTTPS + username + Password + HOTP.