Add OpenSSH certificate signing path

docs/roadmap.md

@@ -218,6 +218,10 @@ resource-scoped capability decisions.
     metadata.
   - `[x]` Approval emits an explicit `ssh-keygen -s ...` command for
     CA/YubiKey use.
+  - `[x]` `geth ssh cert approve --sign` can run `ssh-keygen`, import the
+    resulting OpenSSH certificate, and mark the request signed.
+  - `[x]` Tests cover signing with a generated local OpenSSH CA key when
+    `ssh-keygen` is available.
   - `[x]` `geth ssh revocation add/list/export` persists and exports
     revocations.
   - `[x]` Revocations can be exported as JSONL and OpenSSH KRL specification