Report keychain signature status

docs/architecture.md

@@ -238,8 +238,9 @@ daemon persists local keychain init/admin-key operations and `keychain status`
 reports the reduced local view. `keychain init --signing-key <path>` writes the
 canonical keychain signing payloads, runs `ssh-keygen -Y sign` with the explicit
 `geth.keychain.v1@geth.local` namespace, and stores the resulting OpenSSH
-signatures in local SQLite. Verification and rejection of unsigned replicated
-keychain operations are still future work.
+signatures in local SQLite. `keychain status` reports the stored signature
+count. Verification and rejection of unsigned replicated keychain operations are
+still future work.
 
 The authorization plane is `geth-auth`: resource-local signed operation logs,
 grants, revocations, groups, and `auth explain`. Auth operations reduce into a

docs/roadmap.md

@@ -174,6 +174,7 @@ resource-scoped capability decisions.
   - `[x]` OpenSSH keychain signatures use the explicit
     `geth.keychain.v1@geth.local` namespace.
   - `[x]` Keychain OpenSSH signatures are stored in local SQLite.
+  - `[x]` `geth keychain status` reports the stored keychain signature count.
   - `[x]` Missing `ssh-keygen` or unavailable hardware keys produce clear
     errors during signing.
   - `[x]` Tests cover signed keychain init with a generated local OpenSSH key