Require signed SSH metadata provenance

AGENTS.md

@@ -218,8 +218,9 @@ Roadmap items should be actionable and checkable:
   `resource:ssh:revocations`. The daemon live-syncs known peers using per-peer
   cursors; `[sync] live_sync_enabled` and `live_sync_interval_ms` in
   `config.toml` control that loop. Conflicting records with already-known ids
-  are rejected during sync import; this is pull-only metadata sync, not yet a
-  signed CRDT/resource-log replication model.
+  are rejected during sync import, and new cert-flow/revocation records must
+  carry valid agent-key signed provenance over canonical payloads. This is
+  pull-only metadata sync, not yet a CRDT/resource-log replication model.
 - cr-sqlite apply, iroh-docs, iroh-blobs provider/fetch, Automerge sync,
   broader auth enforcement, and Keyhive/BeeKEM-style authorization are future
   roadmap items unless implemented later.