Require signed SSH metadata provenance

docs/roadmap.md

@@ -270,8 +270,10 @@ resource-scoped capability decisions.
     revocation records with ids that already exist locally.
   - `[x]` Tests verify conflicting SSH cert request and revocation records do
     not overwrite local metadata.
-  - `[ ]` Future completion requires all accepted SSH cert/revocation records
-    to carry signed provenance and reduce cleanly before replication.
+  - `[x]` Accepted SSH cert/revocation records carry agent-key signed
+    provenance over deterministic canonical payloads.
+  - `[x]` Sync import rejects unsigned or invalidly signed cert-flow and
+    revocation records that are not already-known conflicting ids.
 
 ## Phase 3: CAS, KV, And Pubsub
 
@@ -429,8 +431,8 @@ Goal: add authorized stream-oriented management workflows over Iroh.
   - `[ ]` Replace pull-only metadata sync with a resource log or CRDT model.
   - `[x]` Conflicting records with already-known ids are rejected during import
     rather than replacing local metadata.
-  - `[ ]` Unsigned records are rejected or quarantined once signed provenance is
-    part of the metadata format.
+  - `[x]` Unsigned records are rejected during sync import once signed
+    provenance is part of the metadata format.
 
 - `[x]` OpenSSH KRL import/export.
   Acceptance criteria: