Verify stored keychain SSH signatures

AGENTS.md

@@ -126,7 +126,9 @@ Roadmap items should be actionable and checkable:
   `keychain status`. `keychain init --signing-key <path>` signs recorded
   keychain ops with `ssh-keygen -Y sign` under the
   `geth.keychain.v1@geth.local` namespace and stores signatures locally.
-  Verification before accepting replicated keychain ops is still roadmap work.
+  `keychain status` verifies stored signatures with OpenSSH when public key
+  material is available. Verification before accepting replicated keychain ops
+  is still roadmap work.
 - Local CAS supports pin/unpin metadata, surfaced through `cas list`, and
   `cas cleanup` evicts unpinned blobs while retaining pinned blobs. The daemon
   can fetch CAS blobs from an imported signed peer card over Iroh when the peer