Extract reusable keychain sigchain model

README.md

@@ -139,6 +139,10 @@ The bootstrap implementation provides:
 - `geth resource create <kind> <name>`
 - `geth keychain init [--admin-key <path>] [--signing-key <path>]`
 - `geth keychain status`
+- `geth keychain admin-add --admin-key <pub> --signing-key <private> [--principal <name>]`
+- `geth keychain admin-revoke <key-fingerprint> --signing-key <private>`
+- `geth keychain allowed-signers`
+- `geth keychain verify`
 - `geth keychain sync <node-id-or-name>`
 - `geth auth sync <node-id-or-name>`
 - `geth sync status`
@@ -436,6 +440,26 @@ geth node revoke-grant resource:ssh-proxy:local <grant-id> \
 geth node revoke work-laptop --signing-key ~/.ssh/id_ed25519_sk
 ```
 
+Admin SSH keys are managed through the same signed keychain log:
+
+```sh
+geth keychain admin-add \
+  --admin-key ~/.ssh/new_admin.pub \
+  --signing-key ~/.ssh/id_ed25519_sk \
+  --principal admin
+geth keychain allowed-signers > /tmp/geth.allowed_signers
+geth keychain verify
+```
+
+The keychain follows a sigchain model documented in
+`docs/sigchain-keychain.md`: each keychain operation is accepted only if it is
+signed by an admin key from the previously accepted reduced view. This is the
+geth analogue of verifying `git-skm` allowed-signers changes from a prior
+trusted state. The reusable mechanics live in the `geth-keychain` crate,
+including allowed-signers projection, replay verification, and an appendable
+JSONL sigchain file format suitable for static hosting with HTTP caching/range
+requests.
+
 The enrollment flow for a new node is:
 
 ```sh