Certificate revocation API for SSH certificates

[josnyder-2]

Body

Currently, there is no way to revoke a certificate issued by a trusted SSH CA, except by removing the CA entirely. In cases where a single device is compromised, it would be useful to revoke already-issued certificates by serial number, rather than distrusting the entire CA. This would allow an organization to use a smaller number of CAs issuing longer-lived keys, rather than a larger number of CAs issuing shorter-lived keys.