Add SSH cert flows and user service installer

README.md

@@ -15,6 +15,7 @@ It has daemon mode and control mode:
 ```sh
 geth init
 geth daemon run
+geth daemon service install
 geth status
 geth node id
 geth resource list
@@ -26,6 +27,18 @@ registry, module router, local metadata store, and synchronized data structures.
 Most non-daemon commands talk to the daemon through a local Unix socket at
 `$GETH_HOME/run/geth.sock`.
 
+The daemon can also install itself as a user service:
+
+```sh
+geth daemon service install
+geth daemon service status
+geth daemon service uninstall
+```
+
+The bootstrap service managers are systemd user units on Linux, launchd user
+agents on macOS, and per-user scheduled tasks on Windows. These are user-level
+services, not system services.
+
 ## Transport And SSH
 
 All remote node-to-node geth communication is designed to happen over Iroh only.
@@ -37,12 +50,21 @@ explicit namespaces such as `geth.keychain.v1@geth.local`. Future SSH proxying
 may carry SSH protocol bytes over authorized Iroh streams, but the geth transport
 remains Iroh.
 
+SSH certificate request and renewal flows are managed as geth metadata. A node
+can create a certificate request, another machine can approve it and receive an
+explicit `ssh-keygen -s ...` command suitable for a CA key or YubiKey-backed CA,
+and the resulting `-cert.pub` can be imported for distribution. Certificate and
+key revocation entries are tracked locally and can be exported as JSONL for
+distribution. Future Iroh replication will distribute these records between
+authorized nodes.
+
 ## MVP Features
 
 The bootstrap implementation provides:
 
 - `geth init`
 - `geth daemon run`
+- `geth daemon service install|uninstall|start|stop|status|print`
 - `geth status`
 - `geth node id`
 - `geth resource list`
@@ -50,6 +72,15 @@ The bootstrap implementation provides:
 - `geth keychain status`
 - `geth auth explain <subject> <resource> <capability>`
 - local filesystem CAS commands: `add`, `get`, `hash`, `has`, `list`
+- SSH certificate flow metadata:
+  - `geth ssh cert request --public-key <path> --principal <name>`
+  - `geth ssh cert requests`
+  - `geth ssh cert approve <request-id> --ca-key <path>`
+  - `geth ssh cert import <request-id> --cert <path>`
+  - `geth ssh cert list`
+  - `geth ssh revocation add <kind> <target>`
+  - `geth ssh revocation list`
+  - `geth ssh revocation export --out <path>`
 
 Other command groups exist as explicit stubs: `db`, `kv`, `pipe`, `document`,
 `pubsub`, `secret`, and `ssh`.