Support SSH certificates

[mjpieters]

Please add support for exposing all information contained in SSH certificates, as well as generating new keys.

Currently, the SSL public key loader does load, but then discard certificate information.

Can that information please be made available? Ideally, if you have the private key that was used to sign the public key, the ability to verify the signature would be invaluable.

And going in the other direction, please add support for generating such keys. That would require that you can create a SSH certificate object on which you can set a serial (arbitrary uint64), type (user or host), key id, principals, valid dates, critical options and extensions. Signing then only has to generate a nonce and signature to write back to disk.

[MarkusTeufelberger]

Golang has a nice implementation too by the way, in case you don't want to read OpenSSH code: https://pkg.go.dev/golang.org/x/crypto/ssh#Certificate

[reaperhulk]

Tracking:

• [x] Vectors (#7984)
• [x] Parser (#7960)
• [x] Builder
• [x] Deprecate DSA in existing code

There will also be some refactor PRs as we go, including #7982 and #7983.

[reaperhulk]

And we're done 😄