Harden reusable keychain API

docs/roadmap.md

@@ -332,6 +332,11 @@ resource-scoped capability decisions.
   - `[x]` `geth-keychain` exposes transport-neutral allowed-signers projection,
     replay verification with an injected verifier, and appendable JSONL
     sigchain encode/decode helpers for static hosting or alternate transports.
+  - `[x]` `geth-keychain` exposes `KeychainProfile` so non-geth applications
+    can use distinct signature namespaces and default principals.
+  - `[x]` `geth-keychain` exposes a `KeychainSignatureVerifier` trait so
+    callers can plug in OpenSSH, HSM, WebCrypto, service-side, or test
+    verification backends without daemon coupling.
   - `[x]` `docs/sigchain-keychain.md` documents the sigchain data model,
     verification algorithm, commands, and current security limits.
   - `[x]` Missing `ssh-keygen` or unavailable hardware keys produce clear