Add binary OpenSSH KRL export

README.md

@@ -60,8 +60,9 @@ can create a certificate request, another machine can approve it and receive an
 explicit `ssh-keygen -s ...` command suitable for a CA key or YubiKey-backed CA,
 and the resulting `-cert.pub` can be imported for distribution. Certificate and
 key revocation entries are tracked locally and can be exported as JSONL or as an
-OpenSSH KRL specification file for later `ssh-keygen -k` use. Future Iroh
-replication will distribute these records between authorized nodes.
+OpenSSH KRL specification file or a binary OpenSSH KRL generated through
+`ssh-keygen -k`. Future Iroh replication will distribute these records between
+authorized nodes.
 
 ## MVP Features
 
@@ -111,7 +112,7 @@ The bootstrap implementation provides:
   - `geth ssh cert list`
   - `geth ssh revocation add <kind> <target>`
   - `geth ssh revocation list`
-  - `geth ssh revocation export --out <path> [--format jsonl|openssh-krl-spec]`
+  - `geth ssh revocation export --out <path> [--format jsonl|openssh-krl-spec|openssh-krl]`
 - local pipe registry commands: `geth pipe listen/connect`
 
 `geth peer export/import/list` is for untrusted peer-card exchange while live