Add OpenSSH KRL spec export

docs/architecture.md

@@ -116,8 +116,9 @@ roadmap stubs.
 
 `geth-ssh-identity` defines SSH trust namespaces plus certificate request,
 approval, certificate import, and revocation-list data models. The bootstrap
-persists these flows locally and exports revocations as JSONL. It does not yet
-generate OpenSSH KRL binaries or replicate the lists over Iroh.
+persists these flows locally and exports revocations as JSONL or OpenSSH KRL
+specification text. It does not yet generate OpenSSH KRL binaries or replicate
+the lists over Iroh.
 
 ## Keychain, Auth, And Secrets
 

docs/roadmap.md

@@ -189,11 +189,16 @@ resource-scoped capability decisions.
 
 - `[~]` SSH certificate and revocation lifecycle.
   Acceptance criteria:
-  - `geth ssh cert request/requests/approve/import/list` persist local metadata.
-  - Approval emits an explicit `ssh-keygen -s ...` command for CA/YubiKey use.
-  - `geth ssh revocation add/list/export` persists and exports revocations.
-  - Future completion requires auth checks for request, approve, import, publish,
-    and read capabilities.
+  - `[x]` `geth ssh cert request/requests/approve/import/list` persist local
+    metadata.
+  - `[x]` Approval emits an explicit `ssh-keygen -s ...` command for
+    CA/YubiKey use.
+  - `[x]` `geth ssh revocation add/list/export` persists and exports
+    revocations.
+  - `[x]` Revocations can be exported as JSONL and OpenSSH KRL specification
+    text.
+  - `[ ]` Future completion requires auth checks for request, approve, import,
+    publish, and read capabilities.
 
 ## Phase 3: CAS, KV, And Pubsub
 
@@ -277,11 +282,14 @@ Goal: add authorized stream-oriented management workflows over Iroh.
   - Consumers can list current certs/revocations from local state while offline.
   - Conflicting or unsigned records are rejected or quarantined.
 
-- `[ ]` OpenSSH KRL import/export.
+- `[~]` OpenSSH KRL import/export.
   Acceptance criteria:
-  - Revocation records can produce an OpenSSH KRL file.
-  - Existing KRL files can be imported into revocation metadata where possible.
-  - Tests cover serial, key ID, public key, and certificate revocations.
+  - `[x]` Revocation records can produce an OpenSSH KRL specification file.
+  - `[x]` Tests cover serial, key ID, and public key revocation spec lines.
+  - `[ ]` Revocation records can produce an OpenSSH binary KRL file.
+  - `[ ]` Existing KRL files can be imported into revocation metadata where
+    possible.
+  - `[ ]` Tests cover binary KRL export/import and certificate revocations.
 
 ## Phase 5: DB And Documents