Add static keychain publication workflow

docs/roadmap.md

@@ -325,6 +325,37 @@ resource-scoped capability decisions.
     signed admin-key registry operations.
   - `[x]` `geth keychain allowed-signers` exports the active admin key view in
     OpenSSH `allowed_signers` format.
+  - `[x]` `geth keychain allowed-signers --out <path>` writes the active
+    OpenSSH `allowed_signers` projection directly to a file.
+  - `[x]` `geth keychain sign-file --in <path> --out <sig>` signs arbitrary
+    snapshots, such as externally managed `authorized_keys`, with an active
+    admin key under an explicit namespace.
+  - `[x]` `geth keychain verify-file --in <path> --signature <sig>` verifies a
+    snapshot signature against the current keychain-derived `allowed_signers`
+    projection or a supplied `--allowed-signers` file.
+  - `[x]` `geth keychain sigchain --out <path>` writes the appendable JSONL
+    sigchain suitable for static website publication.
+  - `[x]` `geth keychain publish-bundle --out <dir>` writes a static website
+    bundle rooted at `https://example.com/.well-known/sshsigchain/` by default.
+  - `[x]` Publication bundles include `allowed_signers`, `geth.sigchain.jsonl`,
+    `geth.sigchain.checkpoint.json`, and a detached checkpoint signature.
+  - `[x]` Publication bundles can copy and sign external snapshots with
+    `--snapshot <name>=<path>` without making the keychain own their contents.
+  - `[x]` `geth keychain verify-sigchain --in <path>` verifies a JSONL sigchain
+    file by replaying operations and signatures.
+  - `[x]` `geth keychain import-sigchain --in <path>` imports a JSONL sigchain
+    only if replay verification rejects no operations.
+  - `[x]` `geth keychain verify-checkpoint` verifies checkpoint signatures,
+    checkpoint hashes, base URL, and sigchain head consistency.
+  - `[x]` `geth keychain fetch --url <base> --import` fetches static bundles
+    with `curl` for HTTP(S) or filesystem reads for local/file URLs.
+  - `[x]` Static fetch/import records the last accepted checkpoint per source
+    URL and rejects older checkpoints for rollback resistance.
+  - `[x]` `geth keychain explain <op-id>` and `explain-signer <key-id>` provide
+    basic audit output for operations and admin signers.
+  - `[x]` Agent/FIDO signing is supported through OpenSSH by passing a public
+    key or security-key stub to `--signing-key`; PKCS#11 is documented as an
+    ssh-agent-backed flow when loaded with `ssh-add -s <provider>`.
   - `[x]` `geth keychain verify` replays the keychain sigchain against the
     previously accepted admin-key view.
   - `[x]` Reusable sigchain mechanics live in `geth-keychain`, not in daemon