Add OpenSSH KRL spec export

README.md

@@ -59,9 +59,9 @@ SSH certificate request and renewal flows are managed as geth metadata. A node
 can create a certificate request, another machine can approve it and receive an
 explicit `ssh-keygen -s ...` command suitable for a CA key or YubiKey-backed CA,
 and the resulting `-cert.pub` can be imported for distribution. Certificate and
-key revocation entries are tracked locally and can be exported as JSONL for
-distribution. Future Iroh replication will distribute these records between
-authorized nodes.
+key revocation entries are tracked locally and can be exported as JSONL or as an
+OpenSSH KRL specification file for later `ssh-keygen -k` use. Future Iroh
+replication will distribute these records between authorized nodes.
 
 ## MVP Features
 
@@ -100,7 +100,7 @@ The bootstrap implementation provides:
   - `geth ssh cert list`
   - `geth ssh revocation add <kind> <target>`
   - `geth ssh revocation list`
-  - `geth ssh revocation export --out <path>`
+  - `geth ssh revocation export --out <path> [--format jsonl|openssh-krl-spec]`
 
 Other command groups exist as explicit stubs: `pipe` and `ssh`.