Extract reusable keychain sigchain model

docs/roadmap.md

@@ -318,6 +318,22 @@ resource-scoped capability decisions.
   - `[x]` `geth keychain status` reports the stored keychain signature count.
   - `[x]` `geth keychain status` verifies stored keychain signatures against
     canonical payloads with OpenSSH when public key material is available.
+  - `[x]` `AdminKeyAdd` carries OpenSSH public key material, principal, and
+    optional validity metadata so the admin key registry is reconstructable
+    from the signed log itself.
+  - `[x]` `geth keychain admin-add` and `geth keychain admin-revoke` append
+    signed admin-key registry operations.
+  - `[x]` `geth keychain allowed-signers` exports the active admin key view in
+    OpenSSH `allowed_signers` format.
+  - `[x]` `geth keychain verify` replays the keychain sigchain against the
+    previously accepted admin-key view.
+  - `[x]` Reusable sigchain mechanics live in `geth-keychain`, not in daemon
+    orchestration code.
+  - `[x]` `geth-keychain` exposes transport-neutral allowed-signers projection,
+    replay verification with an injected verifier, and appendable JSONL
+    sigchain encode/decode helpers for static hosting or alternate transports.
+  - `[x]` `docs/sigchain-keychain.md` documents the sigchain data model,
+    verification algorithm, commands, and current security limits.
   - `[x]` Missing `ssh-keygen` or unavailable hardware keys produce clear
     errors during signing.
   - `[x]` Tests cover signed keychain init with a generated local OpenSSH key