Import SSH revocation metadata

docs/architecture.md

@@ -140,8 +140,11 @@ approval, certificate import, and revocation-list data models. The bootstrap
 persists these flows locally and exports revocations as JSONL or OpenSSH KRL
 specification text. It can also invoke `ssh-keygen -k` to produce a binary
 OpenSSH KRL; serial and key-ID KRL entries require a CA public key via
-`--ca-public`, matching OpenSSH behavior. It does not yet import existing KRL
-files or replicate the lists over Iroh.
+`--ca-public`, matching OpenSSH behavior. It can import geth JSONL revocation
+exports and OpenSSH KRL specification source files. Binary OpenSSH KRL files are
+not enumerable through OpenSSH tooling, so geth treats binary import as
+unsupported and asks for JSONL or the spec source. Revocation lists are not yet
+replicated over Iroh.
 
 ## Keychain, Auth, And Secrets
 

docs/roadmap.md

@@ -298,9 +298,12 @@ Goal: add authorized stream-oriented management workflows over Iroh.
   - `[x]` Revocation records can produce an OpenSSH binary KRL file.
   - `[x]` Tests cover binary KRL export for public-key revocations when
     `ssh-keygen` is available.
-  - `[ ]` Existing KRL files can be imported into revocation metadata where
-    possible.
-  - `[ ]` Tests cover KRL import and certificate revocations.
+  - `[x]` JSONL exports and OpenSSH KRL specification source files can be
+    imported into revocation metadata.
+  - `[x]` Binary OpenSSH KRL import returns a clear unsupported message because
+    KRL files are not enumerable through OpenSSH tooling.
+  - `[x]` Tests cover JSONL and KRL-spec import.
+  - `[ ]` Tests cover certificate revocations.
 
 ## Phase 5: DB And Documents