Sync SSH metadata over Iroh

README.md

@@ -61,8 +61,9 @@ explicit `ssh-keygen -s ...` command suitable for a CA key or YubiKey-backed CA,
 and the resulting `-cert.pub` can be imported for distribution. Certificate and
 key revocation entries are tracked locally and can be exported as JSONL or as an
 OpenSSH KRL specification file or a binary OpenSSH KRL generated through
-`ssh-keygen -k`. Future Iroh replication will distribute these records between
-authorized nodes.
+`ssh-keygen -k`. `geth ssh cert sync <node-id>` and
+`geth ssh revocation sync <node-id>` pull certificate-flow and revocation
+metadata from an authorized peer over Iroh.
 
 ## MVP Features
 
@@ -112,10 +113,12 @@ The bootstrap implementation provides:
   - `geth ssh cert approve <request-id> --ca-key <path>`
   - `geth ssh cert import <request-id> --cert <path>`
   - `geth ssh cert list`
+  - `geth ssh cert sync <node-id>`
   - `geth ssh revocation add <kind> <target>`
   - `geth ssh revocation list`
   - `geth ssh revocation export --out <path> [--format jsonl|openssh-krl-spec|openssh-krl]`
   - `geth ssh revocation import <path> [--format jsonl|openssh-krl-spec]`
+  - `geth ssh revocation sync <node-id>`
 - local pipe registry commands: `geth pipe listen/connect`
 
 `geth peer export/import/list` is for untrusted peer-card exchange. Peer cards
@@ -131,6 +134,11 @@ has `cas.fetch` on `resource:cas:local`, and the caller verifies that the bytes
 hash to the requested BLAKE3 CAS hash before storing them locally. This is the
 bootstrap transfer path; future work will move provider/fetch behavior to
 `iroh-blobs`.
+`geth ssh cert sync <node-id>` requires `ssh_cert.sync` on `resource:ssh:certs`
+at the peer. `geth ssh revocation sync <node-id>` requires
+`ssh_revocation.sync` on `resource:ssh:revocations`. Both commands merge
+authorized peer metadata into the local store for offline listing and later
+approval/signing workflows.
 Importing or pinging a peer card never grants capabilities by itself.
 When `[iroh].local_discovery = true`, the daemon also advertises and discovers
 signed peer cards on LAN using a geth-specific mDNS TXT payload. That payload is