Add binary OpenSSH KRL export

docs/architecture.md

@@ -138,8 +138,10 @@ streams yet.
 `geth-ssh-identity` defines SSH trust namespaces plus certificate request,
 approval, certificate import, and revocation-list data models. The bootstrap
 persists these flows locally and exports revocations as JSONL or OpenSSH KRL
-specification text. It does not yet generate OpenSSH KRL binaries or replicate
-the lists over Iroh.
+specification text. It can also invoke `ssh-keygen -k` to produce a binary
+OpenSSH KRL; serial and key-ID KRL entries require a CA public key via
+`--ca-public`, matching OpenSSH behavior. It does not yet import existing KRL
+files or replicate the lists over Iroh.
 
 ## Keychain, Auth, And Secrets
 

docs/roadmap.md

@@ -200,7 +200,7 @@ resource-scoped capability decisions.
   - `[x]` `geth ssh revocation add/list/export` persists and exports
     revocations.
   - `[x]` Revocations can be exported as JSONL and OpenSSH KRL specification
-    text.
+    text or as a binary OpenSSH KRL through `ssh-keygen`.
   - `[ ]` Future completion requires auth checks for request, approve, import,
     publish, and read capabilities.
 
@@ -295,10 +295,12 @@ Goal: add authorized stream-oriented management workflows over Iroh.
   Acceptance criteria:
   - `[x]` Revocation records can produce an OpenSSH KRL specification file.
   - `[x]` Tests cover serial, key ID, and public key revocation spec lines.
-  - `[ ]` Revocation records can produce an OpenSSH binary KRL file.
+  - `[x]` Revocation records can produce an OpenSSH binary KRL file.
+  - `[x]` Tests cover binary KRL export for public-key revocations when
+    `ssh-keygen` is available.
   - `[ ]` Existing KRL files can be imported into revocation metadata where
     possible.
-  - `[ ]` Tests cover binary KRL export/import and certificate revocations.
+  - `[ ]` Tests cover KRL import and certificate revocations.
 
 ## Phase 5: DB And Documents