Add SSH cert flows and user service installer

docs/adr/0014-ssh-certificate-flows.md

@@ -0,0 +1,39 @@
+# ADR 0014: SSH Certificate Flows And Revocation Lists
+
+## Status
+
+Accepted.
+
+## Decision
+
+Geth manages OpenSSH certificate request, renewal, approval, import, and
+revocation-list metadata.
+
+A node may request a user or host certificate by submitting its public key,
+principals, requested validity, and optional renewal target. An authorized
+machine can approve that request. Approval does not silently sign inside the
+daemon; it returns an explicit `ssh-keygen -s ...` command that can be run on the
+machine with the CA private key or YubiKey-backed CA key. The resulting
+`-cert.pub` file is imported back into geth for distribution.
+
+Certificate and key revocations are durable records. The bootstrap stores and
+exports them as JSONL. Future work may derive OpenSSH KRL files and replicate
+signed revocation lists over Iroh.
+
+## Consequences
+
+SSH certificate lifecycle management becomes part of the SSH trust integration
+layer without making SSH a geth transport. The daemon can coordinate requests and
+distribution while the CA/YubiKey machine remains the explicit signing point.
+
+Future authorization should protect capabilities such as:
+
+- `ssh_cert.request`
+- `ssh_cert.approve`
+- `ssh_cert.import`
+- `ssh_revocation.publish`
+- `ssh_revocation.read`
+
+The current bootstrap does not claim that revocation reaches offline nodes
+immediately. Revocation distribution is eventual until stronger synchronization
+and policy enforcement are implemented.