Verify stored keychain SSH signatures

docs/architecture.md

@@ -239,8 +239,9 @@ reports the reduced local view. `keychain init --signing-key <path>` writes the
 canonical keychain signing payloads, runs `ssh-keygen -Y sign` with the explicit
 `geth.keychain.v1@geth.local` namespace, and stores the resulting OpenSSH
 signatures in local SQLite. `keychain status` reports the stored signature
-count. Verification and rejection of unsigned replicated keychain operations are
-still future work.
+count and verifies stored signatures against their canonical payloads with
+OpenSSH when possible. Rejection of unsigned or invalid replicated keychain
+operations is still future work.
 
 The authorization plane is `geth-auth`: resource-local signed operation logs,
 grants, revocations, groups, and `auth explain`. Auth operations reduce into a

docs/roadmap.md

@@ -175,10 +175,13 @@ resource-scoped capability decisions.
     `geth.keychain.v1@geth.local` namespace.
   - `[x]` Keychain OpenSSH signatures are stored in local SQLite.
   - `[x]` `geth keychain status` reports the stored keychain signature count.
+  - `[x]` `geth keychain status` verifies stored keychain signatures against
+    canonical payloads with OpenSSH when public key material is available.
   - `[x]` Missing `ssh-keygen` or unavailable hardware keys produce clear
     errors during signing.
   - `[x]` Tests cover signed keychain init with a generated local OpenSSH key
     when `ssh-keygen` is available.
+  - `[x]` Tests cover local OpenSSH verification of stored keychain signatures.
   - `[ ]` Future completion verifies signatures before accepting replicated
     keychain ops.