code: func parseAuthorizedKeys(bytes []byte, allowedLogins []string) (services.CertAuthority, services.Role, error) {
  	pubkey, comment, _, _, err := ssh.ParseAuthorizedKey(bytes)
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  
  	comments, err := url.ParseQuery(comment)
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  	clusterName := comments.Get("clustername")
  	if clusterName == "" {
  		return nil, nil, trace.BadParameter("no clustername provided")
  	}
  
  	// create a new certificate authority
  	ca := services.NewCertAuthority(
  		services.UserCA,
  		clusterName,
  		nil,
  		[][]byte{ssh.MarshalAuthorizedKey(pubkey)},
  		nil)
  
  	// transform old allowed logins into roles
  	role := services.RoleForCertAuthority(ca)
  	role.SetLogins(services.Allow, allowedLogins)
  	ca.AddRole(role.GetName())
  
  	return ca, role, nil
  }
docs: // parseAuthorizedKeys parses keys in the authorized_keys format and
  // returns a services.CertAuthority.