I was following this https://gravitational.com/teleport/docs/openssh_teleport/
/usr/local/bin/tctl auth export --type=user > teleport_user_ca.pub
head teleport_user_ca.pub # cert-authority ssh-rsa AAAAB3Nxxx
# remove the `cert-authority`
vi teleport_user_ca.pub
head teleport_user_ca.pub # ssh-rsa AAAAB3
# validate
ssh-keygen -Lf teleport_user_ca.pub # "teleport_user_ca.pub:1 is not a certificate"
my teleport version
/usr/local/bin/tctl version
Teleport Enterprise v4.2.8git:v4.2.8-0-ga9015b33 go1.13.2