Merge pull request #31 from github/full-sig-support

Support SSHSIG and SK verification
2021-12-29 12:47:28 -05:00 · 2021-12-29 12:47:28 -05:00 · e7c2b70c92
--- a/.editorconfig
+++ b/.editorconfig
@ -0,0 +1,8 @@
+root = true
+
+[*]
+insert_final_newline = true
+
+[*.rb]
+indent_size = 2
+indent_style = space
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@ -20,5 +20,5 @@ jobs:
      run: |
        gem install bundler
        bundle install --jobs 4 --retry 3
-        chmod 600 ./spec/fixtures/*
+        find ./spec/fixtures -type f -exec chmod 600 -- {} +
        bundle exec rspec
--- a/lib/ssh_data.rb
+++ b/lib/ssh_data.rb
@ -34,3 +34,4 @@ require "ssh_data/certificate"
 require "ssh_data/public_key"
 require "ssh_data/private_key"
 require "ssh_data/encoding"
+require "ssh_data/signature"
--- a/lib/ssh_data/encoding.rb
+++ b/lib/ssh_data/encoding.rb
@ -3,6 +3,19 @@ module SSHData
    # Fields in an OpenSSL private key
    # https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key
    OPENSSH_PRIVATE_KEY_MAGIC = "openssh-key-v1\x00"
+
+    OPENSSH_SIGNATURE_MAGIC = "SSHSIG"
+    OPENSSH_SIGNATURE_VERSION = 0x01
+
+    OPENSSH_SIGNATURE_FIELDS = [
+      [:sigversion,     :uint32],
+      [:publickey,      :string],
+      [:namespace,      :string],
+      [:reserved,       :string],
+      [:hash_algorithm, :string],
+      [:signature,      :string],
+    ]
+
    OPENSSH_PRIVATE_KEY_FIELDS = [
      [:ciphername, :string],
      [:kdfname,    :string],
@ -313,6 +326,21 @@ module SSHData
      [key, str_read]
    end

+    def decode_openssh_signature(raw, offset=0)
+      total_read = 0
+
+      magic = raw.byteslice(offset, OPENSSH_SIGNATURE_MAGIC.bytesize)
+      unless magic == OPENSSH_SIGNATURE_MAGIC
+        raise DecodeError, "bad OpenSSH signature"
+      end
+
+      total_read += OPENSSH_SIGNATURE_MAGIC.bytesize
+      offset += total_read
+      data, read = decode_fields(raw, OPENSSH_SIGNATURE_FIELDS, offset)
+      total_read += read
+      [data, total_read]
+    end
+
    # Decode the fields in a certificate.
    #
    # raw    - Binary String certificate as described by RFC4253 section 6.6.
@ -680,6 +708,32 @@ module SSHData
      [value].pack("L>")
    end

+    # Read a uint8 from the provided raw data.
+    #
+    # raw    - A binary String.
+    # offset - The offset into raw at which to read (default 0).
+    #
+    # Returns an Array including the decoded uint8 as an Integer and the
+    # Integer number of bytes read.
+    def decode_uint8(raw, offset=0)
+      if raw.bytesize < offset + 1
+        raise DecodeError, "data too short"
+      end
+
+      uint8 = raw.byteslice(offset, 1).unpack("C").first
+
+      [uint8, 1]
+    end
+
+    # Encoding an integer as a uint8.
+    #
+    # value - The Integer value to encode.
+    #
+    # Returns an encoded representation of the value.
+    def encode_uint8(value)
+      [value].pack("C")
+    end
+
    extend self
  end
 end
--- a/lib/ssh_data/public_key.rb
+++ b/lib/ssh_data/public_key.rb
@ -78,6 +78,7 @@ module SSHData
 end

 require "ssh_data/public_key/base"
+require "ssh_data/public_key/security_key"
 require "ssh_data/public_key/rsa"
 require "ssh_data/public_key/dsa"
 require "ssh_data/public_key/ecdsa"
--- a/lib/ssh_data/public_key/security_key.rb
+++ b/lib/ssh_data/public_key/security_key.rb
@ -0,0 +1,40 @@
+module SSHData
+  module PublicKey
+    module SecurityKey
+
+      # Defaults to match OpenSSH, user presence is required by verification is not.
+      DEFAULT_SK_VERIFY_OPTS = {
+        user_presence_required: true,
+        user_verification_required: false
+      }
+
+      SK_FLAG_USER_PRESENCE     = 0b001
+      SK_FLAG_USER_VERIFICATION = 0b100
+
+      def build_signing_blob(application, signed_data, signature)
+        read = 0
+        sig_algo, raw_sig, signature_read = Encoding.decode_signature(signature)
+        read += signature_read
+        sk_flags, sk_flags_read = Encoding.decode_uint8(signature, read)
+        read += sk_flags_read
+        counter, counter_read = Encoding.decode_uint32(signature, read)
+        read += counter_read
+
+        if read != signature.bytesize
+          raise DecodeError, "unexpected trailing data"
+        end
+
+        application_hash = OpenSSL::Digest::SHA256.digest(application)
+        message_hash = OpenSSL::Digest::SHA256.digest(signed_data)
+
+        blob =
+          application_hash +
+          Encoding.encode_uint8(sk_flags) +
+          Encoding.encode_uint32(counter) +
+          message_hash
+
+        [sig_algo, raw_sig, sk_flags, blob]
+      end
+    end
+  end
+end
--- a/lib/ssh_data/public_key/skecdsa.rb
+++ b/lib/ssh_data/public_key/skecdsa.rb
@ -1,6 +1,7 @@
 module SSHData
  module PublicKey
    class SKECDSA < ECDSA
+      include SecurityKey
      attr_reader :application

      OPENSSL_CURVE_NAME_FOR_CURVE = {
@ -34,8 +35,25 @@ module SSHData
        )
      end

-      def verify(signed_data, signature)
-        raise UnsupportedError, "SK-ECDSA verification is not supported."
+      def verify(signed_data, signature, **opts)
+        opts = DEFAULT_SK_VERIFY_OPTS.merge(opts)
+        unknown_opts = opts.keys - DEFAULT_SK_VERIFY_OPTS.keys
+        raise UnsupportedError, "Verification options #{unknown_opts.inspect} are not supported." unless unknown_opts.empty?
+
+        sig_algo, raw_sig, sk_flags, blob = build_signing_blob(application, signed_data, signature)
+        self.class.check_algorithm!(sig_algo, curve)
+
+        openssl_sig = self.class.openssl_signature(raw_sig)
+        digest = DIGEST_FOR_CURVE[curve]
+
+        result = openssl.verify(digest.new, openssl_sig, blob)
+
+        # We don't know that the flags are correct until after we've validated the signature
+        # which embeds the flags, so always verify the signature first.
+        return false if opts[:user_presence_required] && (sk_flags & SK_FLAG_USER_PRESENCE != SK_FLAG_USER_PRESENCE)
+        return false if opts[:user_verification_required] && (sk_flags & SK_FLAG_USER_VERIFICATION != SK_FLAG_USER_VERIFICATION)
+
+        result
      end

      def ==(other)
--- a/lib/ssh_data/public_key/sked25519.rb
+++ b/lib/ssh_data/public_key/sked25519.rb
@ -1,13 +1,14 @@
 module SSHData
  module PublicKey
    class SKED25519 < ED25519
+      include SecurityKey
      attr_reader :application

      def initialize(algo:, pk:, application:)
        @application = application
        super(algo: algo, pk: pk)
      end
-      
+
      def self.algorithm_identifier
        ALGO_SKED25519
      end
@ -23,8 +24,30 @@ module SSHData
        )
      end

-      def verify(signed_data, signature)
-        raise UnsupportedError, "SK-Ed25519 verification is not supported."
+      def verify(signed_data, signature, **opts)
+        self.class.ed25519_gem_required!
+        opts = DEFAULT_SK_VERIFY_OPTS.merge(opts)
+        unknown_opts = opts.keys - DEFAULT_SK_VERIFY_OPTS.keys
+        raise UnsupportedError, "Verification options #{unknown_opts.inspect} are not supported." unless unknown_opts.empty?
+
+        sig_algo, raw_sig, sk_flags, blob = build_signing_blob(application, signed_data, signature)
+
+        if sig_algo != self.class.algorithm_identifier
+          raise DecodeError, "bad signature algorithm: #{sig_algo.inspect}"
+        end
+
+        result = begin
+            ed25519_key.verify(raw_sig, blob)
+          rescue Ed25519::VerifyError
+            false
+          end
+
+        # We don't know that the flags are correct until after we've validated the signature
+        # which embeds the flags, so always verify the signature first.
+        return false if opts[:user_presence_required] && (sk_flags & SK_FLAG_USER_PRESENCE != SK_FLAG_USER_PRESENCE)
+        return false if opts[:user_verification_required] && (sk_flags & SK_FLAG_USER_VERIFICATION != SK_FLAG_USER_VERIFICATION)
+
+        result
      end

      def ==(other)
--- a/lib/ssh_data/signature.rb
+++ b/lib/ssh_data/signature.rb
@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+module SSHData
+  class Signature
+    PEM_TYPE = "SSH SIGNATURE"
+    SIGNATURE_PREAMBLE = "SSHSIG"
+    MIN_SUPPORTED_VERSION = 1
+    MAX_SUPPORTED_VERSION = 1
+
+    # Spec: no SHA1 or SHA384. In practice, OpenSSH is always going to use SHA512.
+    # Note the actual signing / verify primitive may use a different hash algorithm.
+    # https://github.com/openssh/openssh-portable/blob/b7ffbb17e37f59249c31f1ff59d6c5d80888f689/PROTOCOL.sshsig#L67
+    SUPPORTED_HASH_ALGORITHMS = {
+      "sha256" => OpenSSL::Digest::SHA256,
+      "sha512" => OpenSSL::Digest::SHA512,
+    }
+
+    PERMITTED_RSA_SIGNATURE_ALGORITHMS = [
+      PublicKey::ALGO_RSA_SHA2_256,
+      PublicKey::ALGO_RSA_SHA2_512,
+    ]
+
+    attr_reader :sigversion, :namespace, :signature, :reserved, :hash_algorithm
+
+    # Parses a PEM armored SSH signature.
+    # pem - A PEM encoded SSH signature.
+    #
+    # Returns a Signature instance.
+    def self.parse_pem(pem)
+      pem_type = Encoding.pem_type(pem)
+
+      if pem_type != PEM_TYPE
+        raise DecodeError, "Mismatched PEM type. Expecting '#{PEM_TYPE}', actually '#{pem_type}'."
+      end
+
+      blob = Encoding.decode_pem(pem, pem_type)
+      self.parse_blob(blob)
+    end
+
+    def self.parse_blob(blob)
+      data, read = Encoding.decode_openssh_signature(blob)
+
+      if read != blob.bytesize
+        raise DecodeError, "unexpected trailing data"
+      end
+
+      new(**data)
+    end
+
+    def initialize(sigversion:, publickey:, namespace:, reserved:, hash_algorithm:, signature:)
+      if sigversion > MAX_SUPPORTED_VERSION || sigversion < MIN_SUPPORTED_VERSION
+        raise UnsupportedError, "Signature version is not supported"
+      end
+
+      unless SUPPORTED_HASH_ALGORITHMS.has_key?(hash_algorithm)
+        raise UnsupportedError, "Hash algorithm #{hash_algorithm} is not supported."
+      end
+
+      # Spec: empty namespaces are not permitted.
+      # https://github.com/openssh/openssh-portable/blob/b7ffbb17e37f59249c31f1ff59d6c5d80888f689/PROTOCOL.sshsig#L57
+      raise UnsupportedError, "A namespace is required." if namespace.empty?
+
+      # Spec: ignore 'reserved', don't need to validate that it is empty.
+
+      @sigversion = sigversion
+      @publickey = publickey
+      @namespace = namespace
+      @reserved = reserved
+      @hash_algorithm = hash_algorithm
+      @signature = signature
+    end
+
+    def verify(signed_data, **opts)
+      signing_key = public_key
+
+      # Unwrap the signing key if this signature was created from a certificate.
+      key = signing_key.is_a?(Certificate) ? signing_key.public_key : signing_key
+
+      digest_algorithm = SUPPORTED_HASH_ALGORITHMS[@hash_algorithm]
+
+      if key.is_a?(PublicKey::RSA)
+        sig_algo, * = Encoding.decode_signature(@signature)
+
+        # Spec: If the signature is an RSA signature, the legacy 'ssh-rsa'
+        # identifer is not permitted.
+        # https://github.com/openssh/openssh-portable/blob/b7ffbb17e37f59249c31f1ff59d6c5d80888f689/PROTOCOL.sshsig#L72
+        unless PERMITTED_RSA_SIGNATURE_ALGORITHMS.include?(sig_algo)
+          raise UnsupportedError, "RSA signature #{sig_algo} is not supported."
+        end
+      end
+
+      message_digest = digest_algorithm.digest(signed_data)
+      blob =
+        SIGNATURE_PREAMBLE +
+        Encoding.encode_string(@namespace) +
+        Encoding.encode_string(@reserved || "") +
+        Encoding.encode_string(@hash_algorithm) +
+        Encoding.encode_string(message_digest)
+
+      if key.class.include?(::SSHData::PublicKey::SecurityKey)
+        key.verify(blob, @signature, **opts)
+      else
+        key.verify(blob, @signature)
+      end
+    end
+
+    # Gets the public key from the signature.
+    # If the signature was created from a certificate, this will be an
+    # SSHData::Certificate. Otherwise, this will be a PublicKey algorithm.
+    def public_key
+      public_key_algorithm, _ = Encoding.decode_string(@publickey)
+
+      if PublicKey::ALGOS.include?(public_key_algorithm)
+        PublicKey.parse_rfc4253(@publickey)
+      elsif Certificate::ALGOS.include?(public_key_algorithm)
+        Certificate.parse_rfc4253(@publickey)
+      else
+        raise UnsupportedError, "Public key algorithm #{public_key_algorithm} is not supported."
+      end
+    end
+  end
+end
--- a/spec/certificate_spec.rb
+++ b/spec/certificate_spec.rb
@ -281,6 +281,22 @@ describe SSHData::Certificate do
    SSHData::PublicKey::RSA                 # ca key type
  ]

+  test_cases << [
+    :rsa_leaf_for_skecdsa_ca,               # name
+    "rsa_leaf_for_skecdsa_ca-cert.pub",     # fixture
+    SSHData::Certificate::ALGO_RSA,         # algo
+    SSHData::PublicKey::RSA,                # public key type
+    SSHData::PublicKey::SKECDSA             # ca key type
+  ]
+
+  test_cases << [
+    :rsa_leaf_for_sked25519_ca,             # name
+    "rsa_leaf_for_sked25519_ca-cert.pub",   # fixture
+    SSHData::Certificate::ALGO_RSA,         # algo
+    SSHData::PublicKey::RSA,                # public key type
+    SSHData::PublicKey::SKED25519           # ca key type
+  ]
+
  test_cases.each do |name, fixture_name, algo, public_key_class, ca_key_class|
    describe(name) do
      let(:openssh) { fixture(fixture_name).strip }
--- a/spec/encoding_spec.rb
+++ b/spec/encoding_spec.rb
@ -806,4 +806,67 @@ describe SSHData::Encoding do
      expect(read).to eq(0)
    end
  end
+
+  describe ("#decode_openssh_signature") do
+    let(:signature) {
+      Base64.decode64(%Q(
+        U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgoXgg2XgepEwBr3CQzkHXigy8T8
+        uvs69Dvox5fgnGgPMAAAAEZmlsZQAAAAAAAAAGc2hhNTEyAAAAUwAAAAtzc2gtZWQyNTUx
+        OQAAAECRxENUPwmbRveDvNFOc36EuyMIa6jXWbCVkEQ2dtORyFAnChmr1kHMFX4B9TQm6U
+        ssvYRRUo6ePL5DuAjLP+kD
+      ))
+    }
+
+    it "can decode a signature" do
+      data, total_read = SSHData::Encoding.decode_openssh_signature(signature)
+      expect(total_read).to eq(signature.bytesize)
+      expect(data[:sigversion]).to eq(1)
+      expect(data[:reserved]).to be_empty
+      expect(data[:namespace]).to eq("file")
+      expect(data[:hash_algorithm]).to eq("sha512")
+      expect(data[:signature]).not_to be_empty
+      expect(data[:publickey]).not_to be_empty
+    end
+
+    it "can decode a signature starting at offset" do
+      prefix = "helloworld"
+      signature_appended = prefix + signature
+      data, total_read = SSHData::Encoding.decode_openssh_signature(signature_appended, offset = prefix.bytesize)
+      expect(total_read).to eq(signature.bytesize)
+    end
+
+    it "fails if the signature does not begin with wrong magic prefix" do
+      wrong_magic = signature.gsub(/^SSHSIG/, "NOGOOD")
+      expect { SSHData::Encoding.decode_openssh_signature(wrong_magic) }.to raise_error(SSHData::DecodeError)
+    end
+
+    it "fails if the signature is shorter than magic prefix" do
+      short_sig = "OHHI"
+      expect { SSHData::Encoding.decode_openssh_signature(short_sig) }.to raise_error(SSHData::DecodeError)
+    end
+
+    it "fails if the signature has magic but no decodable signature" do
+      bad_sig = "SSHSIGOHNO"
+      expect { SSHData::Encoding.decode_openssh_signature(bad_sig) }.to raise_error(SSHData::DecodeError)
+    end
+
+    it "fails if the signature is corrupt" do
+      # 6 for the magic prefix
+      # 4 for the signature version (int32)
+      # The next 4 will be the length-prefixed the public key.
+      # Corrupt the key by setting the length to something bogus and maintain the rest of the key.
+      start = 6 + 4
+      finish = start + 4
+      bad_sig = signature.dup
+      bad_sig[start...finish] = "\xFF\xFF\xFF\xFF".force_encoding('BINARY')
+      expect(bad_sig.length).to eq(signature.length)
+      expect { SSHData::Encoding.decode_openssh_signature(bad_sig) }.to raise_error(SSHData::DecodeError)
+    end
+
+    it "fails if the signature is too short" do
+      # Hack a byte off at the end.
+      bad_sig = signature.byteslice((0..-2))
+      expect { SSHData::Encoding.decode_openssh_signature(bad_sig) }.to raise_error(SSHData::DecodeError)
+    end
+  end
 end
--- a/spec/fixtures/gen.sh
+++ b/spec/fixtures/gen.sh
@ -1,7 +1,7 @@
 #!/bin/bash

 generate_security_keys=0
-read -p "Generated security key-backed keys (Requires key and user interaction)? [yN] " -n 1 -r
+read -p "Generate security key-backed keys (Requires key and user interaction)? [yN] " -n 1 -r
 echo
 if [[ $REPLY =~ ^[Yy]$ ]]
 then
@ -15,6 +15,18 @@ ssh-keygen -tdsa -N "" -f ./dsa_ca
 ssh-keygen -tecdsa -N "" -f ./ecdsa_ca
 ssh-keygen -ted25519 -N "" -f ./ed25519_ca

+if [[ $generate_security_keys -eq 1 ]]
+then
+    ssh-keygen -ted25519-sk -N "" -f ./sked25519_ca
+    ssh-keygen -tecdsa-sk -N "" -f ./skecdsa_ca
+
+    ssh-keygen -trsa -N "" -f ./rsa_leaf_for_sked25519_ca
+    ssh-keygen -s sked25519_ca -z 123 -n p1,p2 -O clear -I my-ident -O critical:foo=bar -O extension:baz=qwer -O permit-X11-forwarding rsa_leaf_for_sked25519_ca.pub
+
+    ssh-keygen -trsa -N "" -f ./rsa_leaf_for_skecdsa_ca
+    ssh-keygen -s skecdsa_ca -z 123 -n p1,p2 -O clear -I my-ident -O critical:foo=bar -O extension:baz=qwer -O permit-X11-forwarding rsa_leaf_for_skecdsa_ca.pub
+fi
+
 ssh-keygen -trsa -N "" -f ./rsa_leaf_for_rsa_ca
 ssh-keygen -s rsa_ca -z 123 -n p1,p2 -O clear -I my-ident -O critical:foo=bar -O extension:baz=qwer -O permit-X11-forwarding rsa_leaf_for_rsa_ca.pub

--- a/spec/fixtures/rsa_leaf_for_skecdsa_ca
+++ b/spec/fixtures/rsa_leaf_for_skecdsa_ca
@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEAxzIj0SZz5rXQdCys5Z4A8m7EQ3AIoXm0CGJ8yjgITB0M8HtvM4aV
+BeDe/u+nzU1D24CfLqRFvMUQRhWAERJcla+zwSMmBg1qz92SNa+QYOttiuBhWwgzramO1F
+7TUoJu+1mIS/U7CE2WNJp+TaX5IHLtrPmgQ1yBkGSsW5chHqsYX0V7yp//whDGUCdFWTvB
+/q7VWms4dqrl2Q+IyJtYgpgBOg2DhELnO/1umLx/dLYyyLLfwkWKszBM12tktD0dKbnouZ
+0prxgKt0XUtIOV9ROXXhAJe9T3XWquTjulT2E5FiHtJ3ZGWdnXWFPzmmNlzfkMHj+YqEEa
+oPiOEDgXnYeszaHH6adVuzqwqEt1Wm9Zz5sqpZVaN5pZOK4w6bAFg76lNQG6FM3wyiVgOp
+IddZRJu0ELNC+ZeQ4LRRc+5HOwbptqIMdsjJ4YY55FnmxT7/7dPMDf9Iz7aVm3f7K2wNR0
+nHE5rCGCRItwg/ODjTC+HH2jrV2Uw8xUDeWviuW/AAAFkHgl/vF4Jf7xAAAAB3NzaC1yc2
+EAAAGBAMcyI9Emc+a10HQsrOWeAPJuxENwCKF5tAhifMo4CEwdDPB7bzOGlQXg3v7vp81N
+Q9uAny6kRbzFEEYVgBESXJWvs8EjJgYNas/dkjWvkGDrbYrgYVsIM62pjtRe01KCbvtZiE
+v1OwhNljSafk2l+SBy7az5oENcgZBkrFuXIR6rGF9Fe8qf/8IQxlAnRVk7wf6u1VprOHaq
+5dkPiMibWIKYAToNg4RC5zv9bpi8f3S2Msiy38JFirMwTNdrZLQ9HSm56LmdKa8YCrdF1L
+SDlfUTl14QCXvU911qrk47pU9hORYh7Sd2RlnZ11hT85pjZc35DB4/mKhBGqD4jhA4F52H
+rM2hx+mnVbs6sKhLdVpvWc+bKqWVWjeaWTiuMOmwBYO+pTUBuhTN8MolYDqSHXWUSbtBCz
+QvmXkOC0UXPuRzsG6baiDHbIyeGGOeRZ5sU+/+3TzA3/SM+2lZt3+ytsDUdJxxOawhgkSL
+cIPzg40wvhx9o61dlMPMVA3lr4rlvwAAAAMBAAEAAAGBAIa90OKKOz4lYEMlcTLFJWjYKm
+RfpUbtFy3QyQ7UxjAOOpF1PWxCLg3S5aTXIc/K4wrYv1SChDXDq1Vs97sUi5IpTtNnXjIb
+41OGUn+EKYqV1fxp+RDlxGdFWbsoBZQ7bK0TDBItaOgd62vb0XHewl0DwOgP1yuZqH6uyr
+QNz7Z6D7tqOel/Pzbbt/nCBrPsqzYGt4U5H/GNenrQejsQcdes0K+fMoZF5zp6HNSuNR0S
+ndmKvbcg6Uh6dJAHMhCFgUHwuHib+VyZvMTFZd6VFGiP9g5z8tU3xpIUrkiBTkloy+2XLJ
+MkyWPW9KTgwxiHaY4+txbipdzLSoE7MhkGnP+0Gfev3s6v5wfJgpL/wMvSOyMbHKzZBVgX
+7tx0obfoNFRDsZpS8LB+DOsTJphbFeJFBfTlKRWcdJ+SIy6teI2hrC2Dm6Rc3DM1kpePvv
+hihi1etMalZKsiZBsm8X9HL0Yw9yGn3ehm3C/VuE1uGcrytAvySGvF1YOtxFcjgge3mQAA
+AMEAuf3pctrqSazBFt2Adnq0aQHJhzbKQMfrYeJU1pEX5Jykfz867ZWQfTKmUqZHTc4yv/
+dngezh9rgVeiE+kNgVkRoJujhXjt51tS2F2hX7vBiuj26jMjsub4g2zi9H29EOub2fLeAL
+07AlE9qOuEAGCcx6k7Eh2tM1SC4JuKlTtZySykeHMarm/dg89q9f1XVQcBDXlOVYtQOcrf
+UFi9t31dWFmC0ZFn+b0OD8emXIXBUz2yawESSq5g7Eo09CbUHoAAAAwQDo64oZwoZizfBP
+UUIkKIs0eeJWBOjiI4tLaeMs59+XGdvZKw+pCRhzCy9ygE5SQmumFatqVWyxWX27EXBAh8
+ywaViFrKu6Oc88NGGUcP7qMEsDHbmdujbFByxj5GNjUp79kSArqtpDs01LBjI6m1lT3Vzi
+nLzFxlHIAK8AEOIgqZSs8QOF233R1rRarnHMtXL8zQYq6sGKqNftpNKbIsXzd06B7kwdvd
+TScNRWWJcUu8YL+1iTuM4B0RzlaU1GzIUAAADBANrvHx+coP8QNBbUsrHVBCAAtSZ57+sY
+ls9cdC3JJSejbFTBcqpEJwgkkFltzW6NDoT/oDc3bXtsLo6dEiIrwaiqBCzUI6YWv/8/53
+DtwdpunO+w/m/d2fsMOD7hBCsJq9F8bqjFYS+RmgltKecTnwJ2UmVBjXsxgxQxviKdfGjn
+w0fXy422PdTjRbj3XbyPAy7pdWws6sdU9s6EH2gwELGky088HWX8HxmirfI3JX7tcosANx
+idQYsG+n67hKLOcwAAABN2Y3Nqb25lc0BLZXZpbnMtTUJQAQIDBAUG
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/rsa_leaf_for_skecdsa_ca-cert.pub
+++ b/spec/fixtures/rsa_leaf_for_skecdsa_ca-cert.pub
@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgzkt8R6EX7iCu4+5Fr1Dt4UqYAREilnmKsBX90/2EEUUAAAADAQABAAABgQDHMiPRJnPmtdB0LKzlngDybsRDcAihebQIYnzKOAhMHQzwe28zhpUF4N7+76fNTUPbgJ8upEW8xRBGFYARElyVr7PBIyYGDWrP3ZI1r5Bg622K4GFbCDOtqY7UXtNSgm77WYhL9TsITZY0mn5Npfkgcu2s+aBDXIGQZKxblyEeqxhfRXvKn//CEMZQJ0VZO8H+rtVaazh2quXZD4jIm1iCmAE6DYOEQuc7/W6YvH90tjLIst/CRYqzMEzXa2S0PR0puei5nSmvGAq3RdS0g5X1E5deEAl71Pddaq5OO6VPYTkWIe0ndkZZ2ddYU/OaY2XN+QweP5ioQRqg+I4QOBedh6zNocfpp1W7OrCoS3Vab1nPmyqllVo3mlk4rjDpsAWDvqU1AboUzfDKJWA6kh11lEm7QQs0L5l5DgtFFz7kc7Bum2ogx2yMnhhjnkWebFPv/t08wN/0jPtpWbd/srbA1HSccTmsIYJEi3CD84ONML4cfaOtXZTDzFQN5a+K5b8AAAAAAAAAewAAAAEAAAAIbXktaWRlbnQAAAAMAAAAAnAxAAAAAnAyAAAAAAAAAAD//////////wAAABIAAAADZm9vAAAABwAAAANiYXIAAAAwAAAAA2JhegAAAAgAAAAEcXdlcgAAABVwZXJtaXQtWDExLWZvcndhcmRpbmcAAAAAAAAAAAAAAH8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEqtXuPt8YlfvCd9SNupUrv0RcqseUbzFkiNEttrSCZuD1KKDuDluU/g4t/42YJKPbsBc6/8w2U8urlsg0IZPRvAAAAARzc2g6AAAAdwAAACJzay1lY2RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAASAAAACAoTZ3DnZY5pDal5IIk3wF0T62keDPE120XADZOD6bR9AAAACBdNq4i61BbTncPBPlRrW/MwxiCLYVCrClYwUEwoPTH2gEAAAAO vcsjones@Kevins-MBP
--- a/spec/fixtures/rsa_leaf_for_skecdsa_ca.pub
+++ b/spec/fixtures/rsa_leaf_for_skecdsa_ca.pub
@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHMiPRJnPmtdB0LKzlngDybsRDcAihebQIYnzKOAhMHQzwe28zhpUF4N7+76fNTUPbgJ8upEW8xRBGFYARElyVr7PBIyYGDWrP3ZI1r5Bg622K4GFbCDOtqY7UXtNSgm77WYhL9TsITZY0mn5Npfkgcu2s+aBDXIGQZKxblyEeqxhfRXvKn//CEMZQJ0VZO8H+rtVaazh2quXZD4jIm1iCmAE6DYOEQuc7/W6YvH90tjLIst/CRYqzMEzXa2S0PR0puei5nSmvGAq3RdS0g5X1E5deEAl71Pddaq5OO6VPYTkWIe0ndkZZ2ddYU/OaY2XN+QweP5ioQRqg+I4QOBedh6zNocfpp1W7OrCoS3Vab1nPmyqllVo3mlk4rjDpsAWDvqU1AboUzfDKJWA6kh11lEm7QQs0L5l5DgtFFz7kc7Bum2ogx2yMnhhjnkWebFPv/t08wN/0jPtpWbd/srbA1HSccTmsIYJEi3CD84ONML4cfaOtXZTDzFQN5a+K5b8= vcsjones@Kevins-MBP
--- a/spec/fixtures/rsa_leaf_for_sked25519_ca
+++ b/spec/fixtures/rsa_leaf_for_sked25519_ca
@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEAuDxsZAjV3QkUVhrYF78JRt7e/kDAQLlcmuLNN/GcvD3R1d0r0eV1
+RnDrWtt8kT3WcDxHxVeyyvAa3S1VAUhQOnXbAmc6klEvhf8kd9r/KJbsqKdcyEOhSTlT69
+gg+fopqRa9O+SY+P2mz0Zm6JdVrdmniFVyYq1GKHnlfqUGELhda4URLW53mVa2ahKjFg1o
+QZf+e0zoDVuO6gcZs1bSIYos5BkAER0FSJ+r1UZL+rSYy+mFBXaQ6mDIiWl0/3sqaVRrNl
+qKhCdiffDlp53GBU4u32b8h+BqbS619NC87XbXS9igwu6/+WqG2klrHvYXd2oPjqTnAl4D
+nrCfxyABBkUqh07trJZPqBldrYaogzwUL1LYCdYI5yQGqKivL4uINy9DyZetLFvkPN5mak
+xwADE5n9dSf37tMoQxM7krUoUxrPJ7Y8BCzQ2LRkP51MG9h4JTMQge1FZfBjhlbf5IagoX
+WOfKNwggBBODJvZReW4rpzTLK4ktBVeX6+sdeELXAAAFiO4sBWXuLAVlAAAAB3NzaC1yc2
+EAAAGBALg8bGQI1d0JFFYa2Be/CUbe3v5AwEC5XJrizTfxnLw90dXdK9HldUZw61rbfJE9
+1nA8R8VXssrwGt0tVQFIUDp12wJnOpJRL4X/JHfa/yiW7KinXMhDoUk5U+vYIPn6KakWvT
+vkmPj9ps9GZuiXVa3Zp4hVcmKtRih55X6lBhC4XWuFES1ud5lWtmoSoxYNaEGX/ntM6A1b
+juoHGbNW0iGKLOQZABEdBUifq9VGS/q0mMvphQV2kOpgyIlpdP97KmlUazZaioQnYn3w5a
+edxgVOLt9m/Ifgam0utfTQvO1210vYoMLuv/lqhtpJax72F3dqD46k5wJeA56wn8cgAQZF
+KodO7ayWT6gZXa2GqIM8FC9S2AnWCOckBqiory+LiDcvQ8mXrSxb5DzeZmpMcAAxOZ/XUn
+9+7TKEMTO5K1KFMazye2PAQs0Ni0ZD+dTBvYeCUzEIHtRWXwY4ZW3+SGoKF1jnyjcIIAQT
+gyb2UXluK6c0yyuJLQVXl+vrHXhC1wAAAAMBAAEAAAGAKts7Z4W6ogEzrtftvpBcyxSbEM
+/lKOk1hn4NuN7GU++ZeUNKpzfWMP2hcfAuqOaWlGMhWuGMoLJ7vUmHRZYZu4+g041JzbF+
+Y+hXxQdWMbK5GySI6+/u/XO9MTA3wV3XXMBsAX8I6d1fy/kTmSttJQ16Xve8N9Xu6CnZu
+9iWs9YQ+OfXE8fGRdXtZMCRuX1g5SkyO/Z5wmOVBg0vUgL92taB/Fc155FlWA3K5R/piEO
+jhiTLfMnwK2k2Hokki2HCfD/t7qgQhm76Y412HIXVRZZMiiB5sFvGnT76rBZrcusTgebX0
+2m4XIWAwXgInthen6xn3tV/EqShYo3YBJeTSJle0osZ8M41hJZkQB7IqAwhAdDXIhhbrXt
+BJXnun6Ho0OF+l0qrvgxUq8Adbc50X4Sw7zg4zjdALxPix03i58CMBY+WYGKoC72D2hy39
+k6g7JzA9ba3lPbGcUIN2QSwk0iBTFfTld+lvNhbkkJZOaiwU8tZn4J8Sv84vWFlwLRAAAA
+wDm1mGbDUmJJ9hfWMf1KxDAEqJKXV0W4sPBlF/2kcu86zQsZcE9LwBwcPWvsJXYmo+5Qiq
+vlgtOIVd1e+YfBbvZs+pOFvPDt6mOyTwD46sDOKpqbRk2SPg70aaGmf4+vPTGvonozbzMO
+uGgzrSfRK3BTMfvna3M8jZCWC9v3vo7Nh114fZfUYfg6uF1diy7IEdHmY95QcCLY3QzKPd
+9ndpJ8xVuII3w9OXiPckSzhK/1t/S4jT03WC11SSdYMu8yaAAAAMEA5F9bnNpqzON4TrqD
+uVhEklhNBgGvexcdqof7BFygW3KvG3pMA91ed/z0U6HnGsWW1GVjDzZc9K0H/9RAm+lU+V
+K/Vj+qmJbI+Qp94CAB1C+n0AWASID31J2FYPh6UTeJhi9ULoXQmF7a4PBOyAf0Nd2aP5E+
+Aj+7QhUKPnNO/laaFFWDE+opLQLVjnHlvd3Gxjl8fk/NYHbXKssPQwH5z5eaP3hxY6brpd
+ZSfhjkWMcx5SKlwt5HclFOyOnT0py5AAAAwQDOhityKrwbpnxkEqQ/6swBGL0MbsmlI1fP
+w8IMRilUhD9mqOY4aMg9YsRlxtj/JKGEtIFFbnsl6dQJ++AuDke1JQVIrO5PqvMXL0GLgc
+BxB13PQr2A9GBughOMylA7vWYEuVHkvE25EW80//T+8zMM6Ql07zPWxXJLXBaPxFRykSIU
+1gXvSCspOc7zaIRKispKPm6lysLZPJZBJzY4wB7ff9VN55J2RO1lYFSEWbZPUVtj1UdReE
+tD95dj4kvntA8AAAATdmNzam9uZXNAS2V2aW5zLU1CUA==
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/rsa_leaf_for_sked25519_ca-cert.pub
+++ b/spec/fixtures/rsa_leaf_for_sked25519_ca-cert.pub
@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgL6EcAFjD1fjsU4Tzx4Gb0kMQGjrYQDe2FJrYP8kM8C8AAAADAQABAAABgQC4PGxkCNXdCRRWGtgXvwlG3t7+QMBAuVya4s038Zy8PdHV3SvR5XVGcOta23yRPdZwPEfFV7LK8BrdLVUBSFA6ddsCZzqSUS+F/yR32v8oluyop1zIQ6FJOVPr2CD5+impFr075Jj4/abPRmbol1Wt2aeIVXJirUYoeeV+pQYQuF1rhREtbneZVrZqEqMWDWhBl/57TOgNW47qBxmzVtIhiizkGQARHQVIn6vVRkv6tJjL6YUFdpDqYMiJaXT/eyppVGs2WoqEJ2J98OWnncYFTi7fZvyH4GptLrX00LztdtdL2KDC7r/5aobaSWse9hd3ag+OpOcCXgOesJ/HIAEGRSqHTu2slk+oGV2thqiDPBQvUtgJ1gjnJAaoqK8vi4g3L0PJl60sW+Q83mZqTHAAMTmf11J/fu0yhDEzuStShTGs8ntjwELNDYtGQ/nUwb2HglMxCB7UVl8GOGVt/khqChdY58o3CCAEE4Mm9lF5biunNMsriS0FV5fr6x14QtcAAAAAAAAAewAAAAEAAAAIbXktaWRlbnQAAAAMAAAAAnAxAAAAAnAyAAAAAAAAAAD//////////wAAABIAAAADZm9vAAAABwAAAANiYXIAAAAwAAAAA2JhegAAAAgAAAAEcXdlcgAAABVwZXJtaXQtWDExLWZvcndhcmRpbmcAAAAAAAAAAAAAAEoAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgHRksgHwd+cfdg1asRsUSrNuyaT4qCWcbl+TtPWCRttwAAAAEc3NoOgAAAGcAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAABAL/DReFMJ7RkpYRhYCzYc56wDXRFeqkBdUvLu2DFUQbnu8Boa7QWAjxBq00uyFOTBGILJMGfcXRCX0QeVoICRBwEAAAAM vcsjones@Kevins-MBP
--- a/spec/fixtures/rsa_leaf_for_sked25519_ca.pub
+++ b/spec/fixtures/rsa_leaf_for_sked25519_ca.pub
@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4PGxkCNXdCRRWGtgXvwlG3t7+QMBAuVya4s038Zy8PdHV3SvR5XVGcOta23yRPdZwPEfFV7LK8BrdLVUBSFA6ddsCZzqSUS+F/yR32v8oluyop1zIQ6FJOVPr2CD5+impFr075Jj4/abPRmbol1Wt2aeIVXJirUYoeeV+pQYQuF1rhREtbneZVrZqEqMWDWhBl/57TOgNW47qBxmzVtIhiizkGQARHQVIn6vVRkv6tJjL6YUFdpDqYMiJaXT/eyppVGs2WoqEJ2J98OWnncYFTi7fZvyH4GptLrX00LztdtdL2KDC7r/5aobaSWse9hd3ag+OpOcCXgOesJ/HIAEGRSqHTu2slk+oGV2thqiDPBQvUtgJ1gjnJAaoqK8vi4g3L0PJl60sW+Q83mZqTHAAMTmf11J/fu0yhDEzuStShTGs8ntjwELNDYtGQ/nUwb2HglMxCB7UVl8GOGVt/khqChdY58o3CCAEE4Mm9lF5biunNMsriS0FV5fr6x14Qtc= vcsjones@Kevins-MBP
--- a/spec/fixtures/signatures/create-signatures.sh
+++ b/spec/fixtures/signatures/create-signatures.sh
@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+
+filedir=`dirname $0`
+pushd $filedir
+
+message=$filedir/message
+
+if [ ! -f "$message" ]; then
+    dd if=/dev/urandom count=1 bs=64 | base64 > $message
+fi
+
+create_key_and_sign() {
+    local alg=$1
+    local keysize=$2
+    local key=$filedir/$alg-$keysize-no-options-individual.key
+
+    if [ ! -f "$key" ]; then
+        ssh-keygen -q -N "" -t $alg -b $keysize -C "" -f $key
+    fi
+
+    cat $message | ssh-keygen -Y sign -n file -f $key > $message.$alg-$keysize-no-options-individual.sig
+}
+
+create_key_and_sign_ca() {
+    local ca_alg=$1
+    local ca_keysize=$2
+    local ca_key=$filedir/$ca_alg-$ca_keysize-ca-no-options-certificate.key
+    local leaf_alg=$3
+    local leaf_keysize=$4
+    local keypair=$ca_alg-$ca_keysize-$leaf_alg-$leaf_keysize
+    local leaf_key=$filedir/$keypair-leaf-no-options-certificate.key
+
+    if [ ! -f "$ca_key" ]; then
+        # Create root
+        ssh-keygen -q -N "" -t $ca_alg -b $ca_keysize -C "" -f $ca_key
+    fi
+
+    if [ ! -f "$leaf_key" ]; then
+        # Create leaf
+        ssh-keygen -q -N "" -t $leaf_alg -b $leaf_keysize -C "" -f $leaf_key
+        # Sign the leaf with the root.
+        ssh-keygen -s $ca_key -O clear -I octocat@example.com $leaf_key.pub
+    fi
+
+    cat $message | ssh-keygen -Y sign -n file -f $leaf_key-cert.pub > $message.$keypair-leaf-no-options-certificate.sig
+}
+
+create_key_and_sign_options() {
+    local alg=$1
+    local keysize=$2
+    local options=$3
+    local key=$filedir/$alg-$keysize-$options-individual.key
+
+    if [ ! -f "$key" ]; then
+        ssh-keygen -q -O $options -N "" -t $alg -b $keysize -C "" -f $key
+    fi
+
+    cat $message | ssh-keygen -Y sign -n file -f $key > $message.$alg-$keysize-$options-individual.sig
+}
+
+create_key_and_sign "rsa" 2048
+create_key_and_sign "ecdsa" 256
+create_key_and_sign "ecdsa" 384
+create_key_and_sign "ecdsa" 521
+create_key_and_sign "ed25519" 256
+create_key_and_sign_ca "rsa" 2048 "ecdsa" 256
+create_key_and_sign_ca "ecdsa" 256 "rsa" 2048
+
+generate_security_keys=0
+read -p "Generate security key-backed keys (Requires key and user interaction)? [yN] " -n 1 -r
+echo
+if [[ $REPLY =~ ^[Yy]$ ]]
+then
+    create_key_and_sign "ed25519-sk" 256
+    create_key_and_sign "ecdsa-sk" 256
+
+    create_key_and_sign_ca "ecdsa-sk" 256 "rsa" 2048
+    create_key_and_sign_ca "ed25519-sk" 256 "rsa" 2048
+    create_key_and_sign_ca "rsa" 2048 "ecdsa-sk" 2048
+    create_key_and_sign_ca "rsa" 2048 "ed25519-sk" 2048
+
+    create_key_and_sign_ca "ecdsa-sk" 256 "ed25519-sk" 256
+    create_key_and_sign_ca "ed25519-sk" 256 "ecdsa-sk" 256
+
+    create_key_and_sign_options "ed25519-sk" 256 "no-touch-required"
+    create_key_and_sign_options "ecdsa-sk" 256 "no-touch-required"
+
+    create_key_and_sign_options "ed25519-sk" 256 "verify-required"
+    create_key_and_sign_options "ecdsa-sk" 256 "verify-required"
+fi
+
+popd
--- a/spec/fixtures/signatures/ecdsa-256-ca-no-options-certificate.key
+++ b/spec/fixtures/signatures/ecdsa-256-ca-no-options-certificate.key
@ -0,0 +1,8 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQRJRUVivGDgs7AVFySk8BlI9iI1eN0W
+IRGci9SyV9U2LYz2U13qUqaISKqvxiJwz1ViFBZHPqpnKxnNxk5LUbleAAAAmIA49CqAOP
+QqAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBElFRWK8YOCzsBUX
+JKTwGUj2IjV43RYhEZyL1LJX1TYtjPZTXepSpohIqq/GInDPVWIUFkc+qmcrGc3GTktRuV
+4AAAAgHhv8B74T865nNLq45gYeLqOp1ZOlkulzkWd0YqqOPg0AAAAA
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-256-ca-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/ecdsa-256-ca-no-options-certificate.key.pub
@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBElFRWK8YOCzsBUXJKTwGUj2IjV43RYhEZyL1LJX1TYtjPZTXepSpohIqq/GInDPVWIUFkc+qmcrGc3GTktRuV4= 
--- a/spec/fixtures/signatures/ecdsa-256-no-options-individual.key
+++ b/spec/fixtures/signatures/ecdsa-256-no-options-individual.key
@ -0,0 +1,8 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQS8V7D4BgCh6VCjbCGzzQLRG4h3ewpf
+miWK38sCB/cIX75RVKiAO/kd2BrJ9NnSH1mxIQfYmuhx7UZsJQdSRnFiAAAAmKjXhN2o14
+TdAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLxXsPgGAKHpUKNs
+IbPNAtEbiHd7Cl+aJYrfywIH9whfvlFUqIA7+R3YGsn02dIfWbEhB9ia6HHtRmwlB1JGcW
+IAAAAgOlK7eQyls1ZSyxLhCLa3shPPnAy9ueBsq/TkFiPjW34AAAAA
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-256-no-options-individual.key.pub
+++ b/spec/fixtures/signatures/ecdsa-256-no-options-individual.key.pub
@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLxXsPgGAKHpUKNsIbPNAtEbiHd7Cl+aJYrfywIH9whfvlFUqIA7+R3YGsn02dIfWbEhB9ia6HHtRmwlB1JGcWI= 
--- a/spec/fixtures/signatures/ecdsa-256-rsa-2048-leaf-no-options-certificate.key
+++ b/spec/fixtures/signatures/ecdsa-256-rsa-2048-leaf-no-options-certificate.key
@ -0,0 +1,27 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAQEAu87EgoOapeUcsjCwdoJQ3Zi5q8ckFx0m5jz75itE3c6oHbICu0qo
+6idOe/DtST1gaZkFT6XeNXBiLI2fRFBhd/TUrHVwOkdiFrwaBMv5Xfj6nR8wI1ZrR39ifB
+Z2SJ1qps1pUwkNGooXsZIINp224GYoKsn+6389J9I8QAKzjxWw3MMhyvqFX3p6DJ0ECusg
+BfN0CQSV43yf5uRQXMf0IQQxdA9fRSwA3DjyVtRVjt/HJ/Lb+xRDTcGqIeKZYYUGSjcnFN
+WBOs8SYfaqFH2bokxAecC9EWIx4sXszkgw0BFSiL8jyh2ecDTG54RoOPNDSrK7Kt/qDOTM
+HJm/qpyxcQAAA7je0rn/3tK5/wAAAAdzc2gtcnNhAAABAQC7zsSCg5ql5RyyMLB2glDdmL
+mrxyQXHSbmPPvmK0TdzqgdsgK7SqjqJ0578O1JPWBpmQVPpd41cGIsjZ9EUGF39NSsdXA6
+R2IWvBoEy/ld+PqdHzAjVmtHf2J8FnZInWqmzWlTCQ0aihexkgg2nbbgZigqyf7rfz0n0j
+xAArOPFbDcwyHK+oVfenoMnQQK6yAF83QJBJXjfJ/m5FBcx/QhBDF0D19FLADcOPJW1FWO
+38cn8tv7FENNwaoh4plhhQZKNycU1YE6zxJh9qoUfZuiTEB5wL0RYjHixezOSDDQEVKIvy
+PKHZ5wNMbnhGg480NKsrsq3+oM5Mwcmb+qnLFxAAAAAwEAAQAAAQBh1wAs9h602j0u34qu
+0okKSKxBv0cf+4HuZEreyB/iZezTO4+MvwJsqfmLPCKCC0WU/bD0o3a15Exg5Y7Zaf69HY
+FGLxA+bD2/llL/uLu6pyD4hezwG+9bmhNWjeUlQ0zyhQSfy5FWCCb7zRYWTeed09qNIBp7
+2RelDTNyLXYZzdA88ZGLp0Aj+VRe7KijZdoOEp+BcKa3BNaGAoi1pTAF2J7stjEg/s6ULp
+1uv1J3pQT7YvLOL/31TKRsleR2uH7bJQqVP/rj3c4sB43H8pp4dtSZP3wUVqPXHWCEffPJ
+ODJ/p0TGulK1olfsk96WyIWN/CGn4ADGz7OkzSELbHGZAAAAgAWFgeJnhLIzD4nF5BzP7B
+O0iV3CblO9n/DUWsessnn/h7/WQbDvkS08lxXr/SqE3LHmLSL7PIbW8YhXgbMOawdKETjc
+qhMiQ4n8vZPIKpLwj4eVJj6uELupqNNMJ7aOeTiTfS4Cg4ImwZhildBMELsyPzz8A4GJ3r
+GzHjyG5zi1AAAAgQDnqJO85jTJm0PLdDbybiz6mLv/GdBZbprlbbxKYPZKG6arVe70ySBf
+s3hcz+rloBZsBmpqfGy6yaHxRK3XAi0LzTkpkY4thq8wtsNR+4Ufi+pCFUeCTnM/tAS4vw
+9ygn44AWvotBlrPtzFondw9gQEgB2YojB1T/0p674I4SbguwAAAIEAz4qjvvOc1yPsW7l1
+JKwJAuQWG8BmVlesKlp/BqCNjc4srO7OJeXnbpHSV6woIJDPK3hU2uEkuGtUqSdjzzg2Hs
+gftCoMC8SdeW5z+qj2ETOZwa/y4jmq94nB6TMPHKKiFkF9Vj5/dTinbZhmqhI39ZN9KJ9R
+Mzaj7B5JhGzz2cMAAAAAAQID
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-256-rsa-2048-leaf-no-options-certificate.key-cert.pub
+++ b/spec/fixtures/signatures/ecdsa-256-rsa-2048-leaf-no-options-certificate.key-cert.pub
@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgncVdgnSnZa/Vo1YzWpV3jYS+JUOp4oYf1bcMEe147kcAAAADAQABAAABAQC7zsSCg5ql5RyyMLB2glDdmLmrxyQXHSbmPPvmK0TdzqgdsgK7SqjqJ0578O1JPWBpmQVPpd41cGIsjZ9EUGF39NSsdXA6R2IWvBoEy/ld+PqdHzAjVmtHf2J8FnZInWqmzWlTCQ0aihexkgg2nbbgZigqyf7rfz0n0jxAArOPFbDcwyHK+oVfenoMnQQK6yAF83QJBJXjfJ/m5FBcx/QhBDF0D19FLADcOPJW1FWO38cn8tv7FENNwaoh4plhhQZKNycU1YE6zxJh9qoUfZuiTEB5wL0RYjHixezOSDDQEVKIvyPKHZ5wNMbnhGg480NKsrsq3+oM5Mwcmb+qnLFxAAAAAAAAAAAAAAABAAAAE29jdG9jYXRAZXhhbXBsZS5jb20AAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAGgAAAATZWNkc2Etc2hhMi1uaXN0cDI1NgAAAAhuaXN0cDI1NgAAAEEESUVFYrxg4LOwFRckpPAZSPYiNXjdFiERnIvUslfVNi2M9lNd6lKmiEiqr8YicM9VYhQWRz6qZysZzcZOS1G5XgAAAGQAAAATZWNkc2Etc2hhMi1uaXN0cDI1NgAAAEkAAAAhANeUqp8ktOYrH6EYwtpe8bIR6ijJLStz29qMKQE3JLwiAAAAIFADHpr7ntQ/LdFmGqtiA1zws+9NyvUf2HvPGcCTF4vF ./ecdsa-256-rsa-2048-leaf-no-options-certificate.key.pub
--- a/spec/fixtures/signatures/ecdsa-256-rsa-2048-leaf-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/ecdsa-256-rsa-2048-leaf-no-options-certificate.key.pub
@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7zsSCg5ql5RyyMLB2glDdmLmrxyQXHSbmPPvmK0TdzqgdsgK7SqjqJ0578O1JPWBpmQVPpd41cGIsjZ9EUGF39NSsdXA6R2IWvBoEy/ld+PqdHzAjVmtHf2J8FnZInWqmzWlTCQ0aihexkgg2nbbgZigqyf7rfz0n0jxAArOPFbDcwyHK+oVfenoMnQQK6yAF83QJBJXjfJ/m5FBcx/QhBDF0D19FLADcOPJW1FWO38cn8tv7FENNwaoh4plhhQZKNycU1YE6zxJh9qoUfZuiTEB5wL0RYjHixezOSDDQEVKIvyPKHZ5wNMbnhGg480NKsrsq3+oM5Mwcmb+qnLFx 
--- a/spec/fixtures/signatures/ecdsa-384-no-options-individual.key
+++ b/spec/fixtures/signatures/ecdsa-384-no-options-individual.key
@ -0,0 +1,10 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAiAAAABNlY2RzYS
+1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQQFYpSSxEuzADAx3YATueADSYU3ORA1
+WSxm/0DvBfT8iQnsHRuqy2HDdNPgZQ0RyYsiL9OCwONZjK3P/6mDIrMDZyYUYylMcUd/ts
+FdldsNhMDTybGVmnJFWQK1jnU7qdUAAADIy+Txa8vk8WsAAAATZWNkc2Etc2hhMi1uaXN0
+cDM4NAAAAAhuaXN0cDM4NAAAAGEEBWKUksRLswAwMd2AE7ngA0mFNzkQNVksZv9A7wX0/I
+kJ7B0bqsthw3TT4GUNEcmLIi/TgsDjWYytz/+pgyKzA2cmFGMpTHFHf7bBXZXbDYTA08mx
+lZpyRVkCtY51O6nVAAAAMDxh83VbLbmCQCM/5yvhKsNsWW2/UqKltd6uzedxuECd0ziSjl
+8HU4gLVEElJLhBLgAAAAA=
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-384-no-options-individual.key.pub
+++ b/spec/fixtures/signatures/ecdsa-384-no-options-individual.key.pub
@ -0,0 +1 @@
+ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBAVilJLES7MAMDHdgBO54ANJhTc5EDVZLGb/QO8F9PyJCewdG6rLYcN00+BlDRHJiyIv04LA41mMrc//qYMiswNnJhRjKUxxR3+2wV2V2w2EwNPJsZWackVZArWOdTup1Q== 
--- a/spec/fixtures/signatures/ecdsa-521-no-options-individual.key
+++ b/spec/fixtures/signatures/ecdsa-521-no-options-individual.key
@ -0,0 +1,12 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAArAAAABNlY2RzYS
+1zaGEyLW5pc3RwNTIxAAAACG5pc3RwNTIxAAAAhQQBb0lHP5PFC+uRxvSTi9ZL29nqGqG+
+QzCzy8GvF6s7S5hFb9PEX2SvbAZbQ0zern3MbWF6KLJy2C0GT8by/B6dBWQAi7BPnq67X+
+K2UgAZZStNQi7F19WBTC1RKzuiMXVXTwUJRr8ZkJajD36jrBD10JqIGP5E6bn8r9Wu55N8
+lKI+6woAAAEA4KdrteCna7UAAAATZWNkc2Etc2hhMi1uaXN0cDUyMQAAAAhuaXN0cDUyMQ
+AAAIUEAW9JRz+TxQvrkcb0k4vWS9vZ6hqhvkMws8vBrxerO0uYRW/TxF9kr2wGW0NM3q59
+zG1heiiyctgtBk/G8vwenQVkAIuwT56uu1/itlIAGWUrTUIuxdfVgUwtUSs7ojF1V08FCU
+a/GZCWow9+o6wQ9dCaiBj+ROm5/K/VrueTfJSiPusKAAAAQTGJ+nh7YuVjzrYKynPJIqvy
+A44GSgYTrty5u+yjHfS55OXVXO/WXo4XABbdJp1orzWit+6BCm6OAal9erpJY8EGAAAAAA
+ECAw==
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-521-no-options-individual.key.pub
+++ b/spec/fixtures/signatures/ecdsa-521-no-options-individual.key.pub
@ -0,0 +1 @@
+ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAFvSUc/k8UL65HG9JOL1kvb2eoaob5DMLPLwa8XqztLmEVv08RfZK9sBltDTN6ufcxtYXoosnLYLQZPxvL8Hp0FZACLsE+errtf4rZSABllK01CLsXX1YFMLVErO6IxdVdPBQlGvxmQlqMPfqOsEPXQmogY/kTpufyv1a7nk3yUoj7rCg== 
--- a/spec/fixtures/signatures/ecdsa-sk-256-ca-no-options-certificate.key
+++ b/spec/fixtures/signatures/ecdsa-sk-256-ca-no-options-certificate.key
@ -0,0 +1,10 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2
+RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQS/1sTWhBj/
+VG1vEDgiRlVq1C59/F+Ddju9nI63kGZ9c6kf0ADHVCU+X2XMveorZ/eeBOmEKkpFzQV9nL
+92ACHxAAAABHNzaDoAAADY0W64W9FuuFsAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv
+cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEv9bE1oQY/1RtbxA4IkZVatQuffxfg3Y7vZ
+yOt5BmfXOpH9AAx1QlPl9lzL3qK2f3ngTphCpKRc0FfZy/dgAh8QAAAARzc2g6AQAAAEAz
+YNpvaYFUzakDYeE22Q57MrOUhuZZC6an2iQmyfKg3K7vIlECRdavEEJTJLOpjmKuZsFduZ
+t9a1HaWWisQ11ZAAAAAAAAAAABAgME
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-sk-256-ca-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/ecdsa-sk-256-ca-no-options-certificate.key.pub
@ -0,0 +1 @@
+sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBL/WxNaEGP9UbW8QOCJGVWrULn38X4N2O72cjreQZn1zqR/QAMdUJT5fZcy96itn954E6YQqSkXNBX2cv3YAIfEAAAAEc3NoOg== 
--- a/spec/fixtures/signatures/ecdsa-sk-256-ed25519-sk-256-leaf-no-options-certificate.key
+++ b/spec/fixtures/signatures/ecdsa-sk-256-ed25519-sk-256-leaf-no-options-certificate.key
@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2
+gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACAZ+QatNkYWomlolmKdu+TGkqI326lmnaefsP6X
+waXBqgAAAARzc2g6AAAA4GV3KuZldyrmAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2
+9tAAAAIBn5Bq02RhaiaWiWYp275MaSojfbqWadp5+w/pfBpcGqAAAABHNzaDoBAAAAgNlk
+mx4qqBsdmcI0tdcSpYdmZrbmKyRYt7CgfONESOzJQZImooefwBOERlfIXI+PT+BmrsnbFi
+jgs/tc3qxGXicMfZu6tv4v4kF+18Run53KUgF6frGvup6jiQhlWCrLMe3R+HykfrJWDrEg
+fDj7UNT5twkDZxAXMG3E7Do641NIAAAAAAAAAAAB
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-sk-256-ed25519-sk-256-leaf-no-options-certificate.key-cert.pub
+++ b/spec/fixtures/signatures/ecdsa-sk-256-ed25519-sk-256-leaf-no-options-certificate.key-cert.pub
@ -0,0 +1 @@
+sk-ssh-ed25519-cert-v01@openssh.com AAAAI3NrLXNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIOUUeX8eLl0bqtOTw8lbpTLJIyMqEncpYNDPeOav/OIMAAAAIBn5Bq02RhaiaWiWYp275MaSojfbqWadp5+w/pfBpcGqAAAABHNzaDoAAAAAAAAAAAAAAAEAAAATb2N0b2NhdEBleGFtcGxlLmNvbQAAAAAAAAAAAAAAAP//////////AAAAAAAAAAAAAAAAAAAAfwAAACJzay1lY2RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQS/1sTWhBj/VG1vEDgiRlVq1C59/F+Ddju9nI63kGZ9c6kf0ADHVCU+X2XMveorZ/eeBOmEKkpFzQV9nL92ACHxAAAABHNzaDoAAAB4AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAABJAAAAIED9hCQsE3Za7BMdXOdMADHnmW4iAPntaLlEmEBtyiiUAAAAIQCHIjSE8XmleYbMnni8ObwdpGJPx2dQ+lCxjuJE9l1XlQEAAAAr ./ecdsa-sk-256-ed25519-sk-256-leaf-no-options-certificate.key.pub
--- a/spec/fixtures/signatures/ecdsa-sk-256-ed25519-sk-256-leaf-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/ecdsa-sk-256-ed25519-sk-256-leaf-no-options-certificate.key.pub
@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBn5Bq02RhaiaWiWYp275MaSojfbqWadp5+w/pfBpcGqAAAABHNzaDo= 
--- a/spec/fixtures/signatures/ecdsa-sk-256-no-options-individual.key
+++ b/spec/fixtures/signatures/ecdsa-sk-256-no-options-individual.key
@ -0,0 +1,10 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2
+RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQSqZev++++C
+S0wwzElY2VuaWCEdQ+qQV3BNZuoflLKqUOGPZyKy/R3/kVZaaDmjs/pCoYrrtk/lNoq50r
+dzP0gyAAAABHNzaDoAAADYA4MZKQODGSkAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv
+cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEqmXr/vvvgktMMMxJWNlbmlghHUPqkFdwTW
+bqH5SyqlDhj2cisv0d/5FWWmg5o7P6QqGK67ZP5TaKudK3cz9IMgAAAARzc2g6AQAAAECh
+DDO7nZPhLQpKK3q9xtbuqG8szehfnPiOBDrlb6XuJhTzza95T5yvzyM5A9RYvmVbBbbN6C
+Tk5CtrZTsLGaXaAAAAAAAAAAABAgME
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-sk-256-no-options-individual.key.pub
+++ b/spec/fixtures/signatures/ecdsa-sk-256-no-options-individual.key.pub
@ -0,0 +1 @@
+sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBKpl6/7774JLTDDMSVjZW5pYIR1D6pBXcE1m6h+UsqpQ4Y9nIrL9Hf+RVlpoOaOz+kKhiuu2T+U2irnSt3M/SDIAAAAEc3NoOg== 
--- a/spec/fixtures/signatures/ecdsa-sk-256-no-touch-required-individual.key
+++ b/spec/fixtures/signatures/ecdsa-sk-256-no-touch-required-individual.key
@ -0,0 +1,10 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2
+RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQTvMtb6QxAD
+EWGMnLPfOnK7HG8kL0be/oycV6vNyzPUe4Q/cvYiHdH8PTeLt4d8jzl9XYTFt2d/5AyUOg
+xKPAboAAAABHNzaDoAAADY3g7zt94O87cAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv
+cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEE7zLW+kMQAxFhjJyz3zpyuxxvJC9G3v6MnF
+erzcsz1HuEP3L2Ih3R/D03i7eHfI85fV2Exbdnf+QMlDoMSjwG6AAAAARzc2g6AAAAAEBV
+JZda+EiECd+BmwMUEz94nb6KQmjJ3OfLk6Q1rGPpm6NNgkRoR1yYUGov5QEKBwh8Hd89NY
+SnPsipvkzZKAs9AAAAAAAAAAABAgME
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-sk-256-no-touch-required-individual.key.pub
+++ b/spec/fixtures/signatures/ecdsa-sk-256-no-touch-required-individual.key.pub
@ -0,0 +1 @@
+sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBO8y1vpDEAMRYYycs986crscbyQvRt7+jJxXq83LM9R7hD9y9iId0fw9N4u3h3yPOX1dhMW3Z3/kDJQ6DEo8BugAAAAEc3NoOg== 
--- a/spec/fixtures/signatures/ecdsa-sk-256-rsa-2048-leaf-no-options-certificate.key
+++ b/spec/fixtures/signatures/ecdsa-sk-256-rsa-2048-leaf-no-options-certificate.key
@ -0,0 +1,27 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAQEA6ac9Bmcp8QdW9H1kF1iJZ7De6Wdt2u5HSarevbryTa2H18i05aD8
+2mD+YQTkyYv/RC8smyggIQWlRdObmMlw7PMvmAaF/iP5AfZ+qVi9Kqe/Whx8hotUAJ3IH8
+NST2eJA7abPmN197gz356sU/80wMRy1gQ4t+RXUj1/Ds8+ZdwV+uVcOXfCdBitYACrSvmq
+gTPQgWautvFUVFCFUp99Mu4j/1gKrPHLLndMVwO6DoE/klqV8UbQdPwlYp3ZyDAXX5j7iy
+LAKE8JdvtdqAbmrOLVxd9buaNeOrEG4LqBvclI48aOXkdAtllsHcwWKwwql6V9kJ48OMLR
+uEOn7uAjHQAAA7iOaaDOjmmgzgAAAAdzc2gtcnNhAAABAQDppz0GZynxB1b0fWQXWIlnsN
+7pZ23a7kdJqt69uvJNrYfXyLTloPzaYP5hBOTJi/9ELyybKCAhBaVF05uYyXDs8y+YBoX+
+I/kB9n6pWL0qp79aHHyGi1QAncgfw1JPZ4kDtps+Y3X3uDPfnqxT/zTAxHLWBDi35FdSPX
+8Ozz5l3BX65Vw5d8J0GK1gAKtK+aqBM9CBZq628VRUUIVSn30y7iP/WAqs8csud0xXA7oO
+gT+SWpXxRtB0/CVindnIMBdfmPuLIsAoTwl2+12oBuas4tXF31u5o146sQbguoG9yUjjxo
+5eR0C2WWwdzBYrDCqXpX2Qnjw4wtG4Q6fu4CMdAAAAAwEAAQAAAQEA4739zmrpx6R2zjIW
+SGck7yvH6srEmhuc4qIpH9fDa5FUEjDwmc4UB6t45woFEqphco1ktgsjXeyJzojWZdMbPe
+o/nrflDPT1NkOT6+6x24zMB8IyYlYV18/zC3qvlPP+6d6obOQ3TPB/p1ya7fiX67jPkell
+e2CW+HM2kDHSySYifmehlsNu0ivRpH/v2gg2oYhNlXHekW3qF6K83UxkrBNAmdss+YLQQZ
+6NnfbccMR2/SSL0lO19wBoVTuwBFiopSsm5oLZ9qOzGgbkbyhQlsh11NjaBH4Cj2hHgvz+
+J1s25Rf3LVG6FNd+4iiVIDs0MdhlNu3ua6U6qDgmHK8kQQAAAIEAiyYxqxSubJPewmX8yU
+Di4YViIrZ5StF3U5SjmtUwiaVizPNwSrMpKszfgUSm9Lc8hFH5FCT8wusvwxNA6fnndDpC
+PBcRUkSifBEwxg0fbzx972HPNrb9YJuhxoGjCfsD89F8qxnZrMdtdo4inNoEjZk6+yJdrN
+536AwmMM3H0TkAAACBAPboQBwFv3XvTWM1ywjTV/cA3/X45PY+5x4TDfEt1PvRZfPe5DAF
+rHdrVU1L0CDlWo7WHw/Tpdc6sz38XfR4QkICiNV3DqDZiL30I3kRhKJuzZrTuyUZGTZkHr
+P2jXhtiNsnoO1p7+VUugXVC6ofLrs5I0M9NhyhzKQbeBbitK6NAAAAgQDyQgjb8FtBtDBr
+8Ycs5rKGvd5ANugZHES5dvyADLFECwt2I4HZaIZoPDboJ4d5qaV9t2WxFujz1KOdM1hjmU
+4YcWsau/0yciipd0DhrqbI3WdpQpxhkSFjq2wyNTUv7dkg2zr1wO6zlPIET/WcBpsQWGcd
+yFTKGQZiM73IgESq0QAAAAAB
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-sk-256-rsa-2048-leaf-no-options-certificate.key-cert.pub
+++ b/spec/fixtures/signatures/ecdsa-sk-256-rsa-2048-leaf-no-options-certificate.key-cert.pub
@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg1nHZtEfk0PH7LXQil/l7gjrkeY63U/yzZH9Qo6cws5MAAAADAQABAAABAQDppz0GZynxB1b0fWQXWIlnsN7pZ23a7kdJqt69uvJNrYfXyLTloPzaYP5hBOTJi/9ELyybKCAhBaVF05uYyXDs8y+YBoX+I/kB9n6pWL0qp79aHHyGi1QAncgfw1JPZ4kDtps+Y3X3uDPfnqxT/zTAxHLWBDi35FdSPX8Ozz5l3BX65Vw5d8J0GK1gAKtK+aqBM9CBZq628VRUUIVSn30y7iP/WAqs8csud0xXA7oOgT+SWpXxRtB0/CVindnIMBdfmPuLIsAoTwl2+12oBuas4tXF31u5o146sQbguoG9yUjjxo5eR0C2WWwdzBYrDCqXpX2Qnjw4wtG4Q6fu4CMdAAAAAAAAAAAAAAABAAAAE29jdG9jYXRAZXhhbXBsZS5jb20AAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAH8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEv9bE1oQY/1RtbxA4IkZVatQuffxfg3Y7vZyOt5BmfXOpH9AAx1QlPl9lzL3qK2f3ngTphCpKRc0FfZy/dgAh8QAAAARzc2g6AAAAeQAAACJzay1lY2RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAASgAAACEAjfU8tkbnk/DeISOXmRughSdqLqKYC2kSJ01qcK/KQgcAAAAhAP6BfeX7LyTSRSjyTTcldHjBBapzFjb2D3FRx/3CWQ6bAQAAAAs= ./ecdsa-sk-256-rsa-2048-leaf-no-options-certificate.key.pub
--- a/spec/fixtures/signatures/ecdsa-sk-256-rsa-2048-leaf-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/ecdsa-sk-256-rsa-2048-leaf-no-options-certificate.key.pub
@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDppz0GZynxB1b0fWQXWIlnsN7pZ23a7kdJqt69uvJNrYfXyLTloPzaYP5hBOTJi/9ELyybKCAhBaVF05uYyXDs8y+YBoX+I/kB9n6pWL0qp79aHHyGi1QAncgfw1JPZ4kDtps+Y3X3uDPfnqxT/zTAxHLWBDi35FdSPX8Ozz5l3BX65Vw5d8J0GK1gAKtK+aqBM9CBZq628VRUUIVSn30y7iP/WAqs8csud0xXA7oOgT+SWpXxRtB0/CVindnIMBdfmPuLIsAoTwl2+12oBuas4tXF31u5o146sQbguoG9yUjjxo5eR0C2WWwdzBYrDCqXpX2Qnjw4wtG4Q6fu4CMd 
--- a/spec/fixtures/signatures/ecdsa-sk-256-verify-required-individual.key
+++ b/spec/fixtures/signatures/ecdsa-sk-256-verify-required-individual.key
@ -0,0 +1,10 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2
+RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQQJAU0yOCIV
+F96MrdZmzm4kLbjyLYJsGrgR7DtS9Rz3V1FJd/VbFPso0k31vzv99pKUfC++7lZ8EzePZE
+t50HnqAAAABHNzaDoAAADYoyG7SqMhu0oAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv
+cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEECQFNMjgiFRfejK3WZs5uJC248i2CbBq4Ee
+w7UvUc91dRSXf1WxT7KNJN9b87/faSlHwvvu5WfBM3j2RLedB56gAAAARzc2g6BQAAAEDY
+qAcHBQh1WTyTItQa3Ltj0B96ERpc2t0Z3i7vuDn0gHKLYxo4fuCmHXkoJ/5FDS0g3bJC+W
+iaEBUjz66TR2k3AAAAAAAAAAABAgME
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ecdsa-sk-256-verify-required-individual.key.pub
+++ b/spec/fixtures/signatures/ecdsa-sk-256-verify-required-individual.key.pub
@ -0,0 +1 @@
+sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBAkBTTI4IhUX3oyt1mbObiQtuPItgmwauBHsO1L1HPdXUUl39VsU+yjSTfW/O/32kpR8L77uVnwTN49kS3nQeeoAAAAEc3NoOg== 
--- a/spec/fixtures/signatures/ed25519-256-no-options-individual.key
+++ b/spec/fixtures/signatures/ed25519-256-no-options-individual.key
@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACDV7hH4CRT7JsJUjEY23FF24eyvgMEP4EcNrpdjfQVcsAAAAIjf/Jmu3/yZ
+rgAAAAtzc2gtZWQyNTUxOQAAACDV7hH4CRT7JsJUjEY23FF24eyvgMEP4EcNrpdjfQVcsA
+AAAEAfim6iqc8QW3FuW3to7V7rOWy1Q8z2IoyVvF9c5zhh0NXuEfgJFPsmwlSMRjbcUXbh
+7K+AwQ/gRw2ul2N9BVywAAAAAAECAwQF
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ed25519-256-no-options-individual.key.pub
+++ b/spec/fixtures/signatures/ed25519-256-no-options-individual.key.pub
@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINXuEfgJFPsmwlSMRjbcUXbh7K+AwQ/gRw2ul2N9BVyw 
--- a/spec/fixtures/signatures/ed25519-sk-256-ca-no-options-certificate.key
+++ b/spec/fixtures/signatures/ed25519-sk-256-ca-no-options-certificate.key
@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2
+gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACBfXxOjCEz0FXP7GPbP+iDESwJTDePAicT8y6th
+rX8d9gAAAARzc2g6AAAA4JTFg1qUxYNaAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2
+9tAAAAIF9fE6MITPQVc/sY9s/6IMRLAlMN48CJxPzLq2Gtfx32AAAABHNzaDoBAAAAgGfK
+nWYYhGAV72VfQsRd0T4EOWdcCNFrAi/a1pT6Nk0+6QiuayvqUxbXqIYqj7M/Wz4AIJPkNS
+Qtjphxtny0aNg6IKJhJ06U9ENE6rnXisNtQKD+tLSE6FxgA3u6IV1hRJeznnELdpqjhHIT
+JluClGhdVilgVNnYvCKTvf8oEX2+AAAAAAAAAAAB
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ed25519-sk-256-ca-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/ed25519-sk-256-ca-no-options-certificate.key.pub
@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIF9fE6MITPQVc/sY9s/6IMRLAlMN48CJxPzLq2Gtfx32AAAABHNzaDo= 
--- a/spec/fixtures/signatures/ed25519-sk-256-ecdsa-sk-256-leaf-no-options-certificate.key
+++ b/spec/fixtures/signatures/ed25519-sk-256-ecdsa-sk-256-leaf-no-options-certificate.key
@ -0,0 +1,10 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2
+RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQSKvbfFxKJw
+Vq0pXzCdb5RMqclNGjJTEi060who0ceBq3kfFvXW1jXBSJkpvrX8tjcJAD9psxW28a3DrT
+RA1TgNAAAABHNzaDoAAADY0jvnm9I755sAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv
+cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEir23xcSicFatKV8wnW+UTKnJTRoyUxItOt
+MIaNHHgat5Hxb11tY1wUiZKb61/LY3CQA/abMVtvGtw600QNU4DQAAAARzc2g6AQAAAEDO
+Hv3fWxW3kKWZuKAo/h+Jv73V3MQAHasMyakHorNnt+xQgw4BAXltleaMjwqRcKADnJFWFv
+NFYnCDuoFNmi3RAAAAAAAAAAABAgME
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ed25519-sk-256-ecdsa-sk-256-leaf-no-options-certificate.key-cert.pub
+++ b/spec/fixtures/signatures/ed25519-sk-256-ecdsa-sk-256-leaf-no-options-certificate.key-cert.pub
@ -0,0 +1 @@
+sk-ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAK3NrLWVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgCIuE3pqGCgkjimtn7nDhJuDoUKwb6FWWDhStwOFAiG4AAAAIbmlzdHAyNTYAAABBBIq9t8XEonBWrSlfMJ1vlEypyU0aMlMSLTrTCGjRx4GreR8W9dbWNcFImSm+tfy2NwkAP2mzFbbxrcOtNEDVOA0AAAAEc3NoOgAAAAAAAAAAAAAAAQAAABNvY3RvY2F0QGV4YW1wbGUuY29tAAAAAAAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAABKAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIF9fE6MITPQVc/sY9s/6IMRLAlMN48CJxPzLq2Gtfx32AAAABHNzaDoAAABnAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAQCp+LTvuu55CgU1GQzR7iVYK8NX7SBpJpwZIFpo5ubR+gXHiorMjldbMqMwuaCbhilz60wJVMTeo3BkVsxYSpgABAAAALg== ./ed25519-sk-256-ecdsa-sk-256-leaf-no-options-certificate.key.pub
--- a/spec/fixtures/signatures/ed25519-sk-256-ecdsa-sk-256-leaf-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/ed25519-sk-256-ecdsa-sk-256-leaf-no-options-certificate.key.pub
@ -0,0 +1 @@
+sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBIq9t8XEonBWrSlfMJ1vlEypyU0aMlMSLTrTCGjRx4GreR8W9dbWNcFImSm+tfy2NwkAP2mzFbbxrcOtNEDVOA0AAAAEc3NoOg== 
--- a/spec/fixtures/signatures/ed25519-sk-256-no-options-individual.key
+++ b/spec/fixtures/signatures/ed25519-sk-256-no-options-individual.key
@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2
+gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACAjkNI5Hlnr8a+JEHx0kQijhugXY5u3jS8cZ9ig
+RNx9rQAAAARzc2g6AAAA4AlHyKcJR8inAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2
+9tAAAAICOQ0jkeWevxr4kQfHSRCKOG6Bdjm7eNLxxn2KBE3H2tAAAABHNzaDoBAAAAgD9Y
+A64/inh4d4N/mz+UV6PcUnUIH6rCiaGwdTeKFQu5Rfz0QUeyBUM8vFa3i6ArIem01Un2y3
+r891Oe8YLpc11zv2RVPOQyysK2BqeDZL9/n4CZ1OIG7LRv6ss5f0Y34+pskwWVCsyqJyXP
+UGS95AtxE56SJHmVsnwQFRJ2VZtcAAAAAAAAAAAB
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ed25519-sk-256-no-options-individual.key.pub
+++ b/spec/fixtures/signatures/ed25519-sk-256-no-options-individual.key.pub
@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAICOQ0jkeWevxr4kQfHSRCKOG6Bdjm7eNLxxn2KBE3H2tAAAABHNzaDo= 
--- a/spec/fixtures/signatures/ed25519-sk-256-no-touch-required-individual.key
+++ b/spec/fixtures/signatures/ed25519-sk-256-no-touch-required-individual.key
@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2
+gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACBa6hNA0i4IH7hxPkdFa7uAjL3OcQg+eskZKdcW
+8nA61wAAAARzc2g6AAAA4J+AUYCfgFGAAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2
+9tAAAAIFrqE0DSLggfuHE+R0Vru4CMvc5xCD56yRkp1xbycDrXAAAABHNzaDoAAAAAgOsC
+49O9hw2JVPeHAT160JVQ0aCbA7TQoHOFs+OtkUEop+1w0zLDBXaoIyhuqNLws3oOgRdYtj
+bg2LnMFLBHfdqApdHA16Du5OVXvVDMfBPqiMk/Nfx15O9LZC6OY/USNhjCn7sPBQCYMOis
+mpRvqfsRrccw9ycq//aKmGwVeLjrAAAAAAAAAAAB
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ed25519-sk-256-no-touch-required-individual.key.pub
+++ b/spec/fixtures/signatures/ed25519-sk-256-no-touch-required-individual.key.pub
@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIFrqE0DSLggfuHE+R0Vru4CMvc5xCD56yRkp1xbycDrXAAAABHNzaDo= 
--- a/spec/fixtures/signatures/ed25519-sk-256-rsa-2048-leaf-no-options-certificate.key
+++ b/spec/fixtures/signatures/ed25519-sk-256-rsa-2048-leaf-no-options-certificate.key
@ -0,0 +1,27 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAQEAzJOqZNlLLQmKQPIs1GgQPoXfOeR9Xv1qiVZ0sJuEUZpHXI9z4yTp
+wteXzKq9+lNduunX3pwcPhVotGdho0LZlwh10a6cgFShX0kiAJgCMSuxXPN85nPaoZq6Bf
+yJz6gwv0BHYlOiC5ultQwFkIhxIgfhNtcBfbMmuNHXhTMLX9+NHd7MGin++AyVllVroDV+
+Ah+ns8uP5pTW/yyrr6lXe2Gju6SpJurwLwVbSs9jwbfvZ7bzeaCwOCFH/eaSimB6cnPIdC
+3ZFQj/2h4qu3MA5kR6xDoLA8TnNGYRSRY6ccpy4RsjgmYZgxxwblZEC6hy+RxaLcIlceri
+uVJmJIYf6wAAA7gZYV8GGWFfBgAAAAdzc2gtcnNhAAABAQDMk6pk2UstCYpA8izUaBA+hd
+855H1e/WqJVnSwm4RRmkdcj3PjJOnC15fMqr36U1266dfenBw+FWi0Z2GjQtmXCHXRrpyA
+VKFfSSIAmAIxK7Fc83zmc9qhmroF/InPqDC/QEdiU6ILm6W1DAWQiHEiB+E21wF9sya40d
+eFMwtf340d3swaKf74DJWWVWugNX4CH6ezy4/mlNb/LKuvqVd7YaO7pKkm6vAvBVtKz2PB
+t+9ntvN5oLA4IUf95pKKYHpyc8h0LdkVCP/aHiq7cwDmRHrEOgsDxOc0ZhFJFjpxynLhGy
+OCZhmDHHBuVkQLqHL5HFotwiVx6uK5UmYkhh/rAAAAAwEAAQAAAQAgrSV2Xk7nrrJqlUQb
+2VNe6TsyoBB2b7vom+qfmveToTTsz+0OxwKfoJgalNsrdM1v4ZIdeIn6UKkcx7aMwUzIFw
+3apC1TQjFUavYHakBPYk8+LZYxqSeu0GwOMLxCcvb2VWoRhpJHkGDzfiwVXfXUHbYXcFhI
+n6j7tGjcWb7jXSRE++bOXXwfqrtyqlxsM6Kg07INwm2Sx8Rv3k+xFxPRQMQi3yG7o+KEZk
+ZGsKrQ4unX7OE6WZD4WuL516tHH3rcxQN5VDvlv/haSlSr0el40yntmMG0K2SnSajOq65B
+pb7c8V6DdmYryqzJ+IFzsAj92YzlgYkVz0S3Rxg9pieBAAAAgGoDyGFUPbmZJr1LZSmXy2
+WM+nqSDGG4L6tav1T6R6jqtrSSPYBw0Dl9+7F9lXR6uiIp/xtay2K4hSXrsGCT9+dzmauO
+pRsQshhuZjJjOG32Spdz61LL80IOL5kFGwGRqiH+oYC5F4GQohNNyXd4pLzapOKAqsO5/O
+tOyKelYSADAAAAgQD+Xp0ruw1rbmSpv7zlzA4YZmjFep5kvxYHf73Mqy+lb6Uqcxnjp8xD
+q/GzuTPUOhO7vmLRz5BlQUJTRVQjjS3PULfTmjR1qCPUCS34lhvh8mZrWM2f9T2pyWXVkJ
+gh3edTI64NSupFxoaHIxlv2Ovv2C9DAzUk8PG+SAxlh1P+2wAAAIEAzeNZNOhZQ0uqMVsA
+oKrGF7sO82eIQdHFQu/DZmrsz0lZirRcGHrGrd/j8yla9htodrKnJ3RjjlEQ9ZVjpbN4dv
+yQnYl5Tzm80S2CkBmi5rxjB95lfWy0N8bMlLsGJMXfyRoOzLtsVM7bi9uwXuerq5SvZUBO
+PBfnX/Qp8HSKiDEAAAAAAQID
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ed25519-sk-256-rsa-2048-leaf-no-options-certificate.key-cert.pub
+++ b/spec/fixtures/signatures/ed25519-sk-256-rsa-2048-leaf-no-options-certificate.key-cert.pub
@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgHNJX//1GGX40fDd5Oj0mySGmNa8C6OIZiDk406L7J+cAAAADAQABAAABAQDMk6pk2UstCYpA8izUaBA+hd855H1e/WqJVnSwm4RRmkdcj3PjJOnC15fMqr36U1266dfenBw+FWi0Z2GjQtmXCHXRrpyAVKFfSSIAmAIxK7Fc83zmc9qhmroF/InPqDC/QEdiU6ILm6W1DAWQiHEiB+E21wF9sya40deFMwtf340d3swaKf74DJWWVWugNX4CH6ezy4/mlNb/LKuvqVd7YaO7pKkm6vAvBVtKz2PBt+9ntvN5oLA4IUf95pKKYHpyc8h0LdkVCP/aHiq7cwDmRHrEOgsDxOc0ZhFJFjpxynLhGyOCZhmDHHBuVkQLqHL5HFotwiVx6uK5UmYkhh/rAAAAAAAAAAAAAAABAAAAE29jdG9jYXRAZXhhbXBsZS5jb20AAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAEoAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgX18TowhM9BVz+xj2z/ogxEsCUw3jwInE/MurYa1/HfYAAAAEc3NoOgAAAGcAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAABA7ClwqWR1IzAKBfxW+oXqXgEcQmz8HmBVOONm6FF/H3QpETpdD8vUFCaCWcK2GUzfeD/PBel+YbhtXJW1MRzACgEAAAAI ./ed25519-sk-256-rsa-2048-leaf-no-options-certificate.key.pub
--- a/spec/fixtures/signatures/ed25519-sk-256-rsa-2048-leaf-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/ed25519-sk-256-rsa-2048-leaf-no-options-certificate.key.pub
@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMk6pk2UstCYpA8izUaBA+hd855H1e/WqJVnSwm4RRmkdcj3PjJOnC15fMqr36U1266dfenBw+FWi0Z2GjQtmXCHXRrpyAVKFfSSIAmAIxK7Fc83zmc9qhmroF/InPqDC/QEdiU6ILm6W1DAWQiHEiB+E21wF9sya40deFMwtf340d3swaKf74DJWWVWugNX4CH6ezy4/mlNb/LKuvqVd7YaO7pKkm6vAvBVtKz2PBt+9ntvN5oLA4IUf95pKKYHpyc8h0LdkVCP/aHiq7cwDmRHrEOgsDxOc0ZhFJFjpxynLhGyOCZhmDHHBuVkQLqHL5HFotwiVx6uK5UmYkhh/r 
--- a/spec/fixtures/signatures/ed25519-sk-256-verify-required-individual.key
+++ b/spec/fixtures/signatures/ed25519-sk-256-verify-required-individual.key
@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2
+gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACAq7i7WbnbFKtCXgcsqzURkZ4UVTKGvO3FUlpYn
+nNmEiwAAAARzc2g6AAAA4Elts4FJbbOBAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2
+9tAAAAICruLtZudsUq0JeByyrNRGRnhRVMoa87cVSWliec2YSLAAAABHNzaDoFAAAAgNqs
+9NuBCG9+E39/cn4ycRLzaBv4SqH/z3Kik1TWsBOAFUtLStrXxWULqC+w6b6HLn/MgJPDKr
+3k3OXkBLP/JVB6wLq2XWQ+Odaz2nY8F5JJZnQ9xqAWDtKZwr/j/4++Z8jK3rVPAYhNszaQ
+1v7E5EFtvwnEWICWAbnsxprtI1vDAAAAAAAAAAAB
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/ed25519-sk-256-verify-required-individual.key.pub
+++ b/spec/fixtures/signatures/ed25519-sk-256-verify-required-individual.key.pub
@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAICruLtZudsUq0JeByyrNRGRnhRVMoa87cVSWliec2YSLAAAABHNzaDo= 
--- a/spec/fixtures/signatures/message
+++ b/spec/fixtures/signatures/message
@ -0,0 +1 @@
+Z0dzRu/AfSjNd7H1LlEk/vxw/tuGVeY3NSzb8wxSw6lAN9o+nefDntF9Ij3u9oj6Jhis6aQP6iCv3YHHcKfd9A==
--- a/spec/fixtures/signatures/message.ecdsa-256-no-options-individual.sig
+++ b/spec/fixtures/signatures/message.ecdsa-256-no-options-individual.sig
@ -0,0 +1,7 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAGgAAAATZWNkc2Etc2hhMi1uaXN0cDI1NgAAAAhuaXN0cDI1NgAAAE
+EEvFew+AYAoelQo2whs80C0RuId3sKX5olit/LAgf3CF++UVSogDv5HdgayfTZ0h9ZsSEH
+2Jroce1GbCUHUkZxYgAAAARmaWxlAAAAAAAAAAZzaGE1MTIAAABkAAAAE2VjZHNhLXNoYT
+ItbmlzdHAyNTYAAABJAAAAIQDvfhSYHqpZAFobLpVFyDOVL+IewoqrKgwrLSLmbKxGEQAA
+ACAN814EiAC5pXxgmt2Un7fFjUz5eauiSJqCdOwhfuGZ/A==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ecdsa-256-rsa-2048-leaf-no-options-certificate.sig
+++ b/spec/fixtures/signatures/message.ecdsa-256-rsa-2048-leaf-no-options-certificate.sig
@ -0,0 +1,20 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAmcAAAAcc3NoLXJzYS1jZXJ0LXYwMUBvcGVuc3NoLmNvbQAAACCdxV
+2CdKdlr9WjVjNalXeNhL4lQ6nihh/VtwwR7XjuRwAAAAMBAAEAAAEBALvOxIKDmqXlHLIw
+sHaCUN2YuavHJBcdJuY8++YrRN3OqB2yArtKqOonTnvw7Uk9YGmZBU+l3jVwYiyNn0RQYX
+f01Kx1cDpHYha8GgTL+V34+p0fMCNWa0d/YnwWdkidaqbNaVMJDRqKF7GSCDadtuBmKCrJ
+/ut/PSfSPEACs48VsNzDIcr6hV96egydBArrIAXzdAkEleN8n+bkUFzH9CEEMXQPX0UsAN
+w48lbUVY7fxyfy2/sUQ03BqiHimWGFBko3JxTVgTrPEmH2qhR9m6JMQHnAvRFiMeLF7M5I
+MNARUoi/I8odnnA0xueEaDjzQ0qyuyrf6gzkzByZv6qcsXEAAAAAAAAAAAAAAAEAAAATb2
+N0b2NhdEBleGFtcGxlLmNvbQAAAAAAAAAAAAAAAP//////////AAAAAAAAAAAAAAAAAAAA
+aAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQRJRUVivGDgs7AVFy
+Sk8BlI9iI1eN0WIRGci9SyV9U2LYz2U13qUqaISKqvxiJwz1ViFBZHPqpnKxnNxk5LUble
+AAAAZAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAASQAAACEA15SqnyS05isfoRjC2l7xsh
+HqKMktK3Pb2owpATckvCIAAAAgUAMemvue1D8t0WYaq2IDXPCz703K9R/Ye88ZwJMXi8UA
+AAAEZmlsZQAAAAAAAAAGc2hhNTEyAAABFAAAAAxyc2Etc2hhMi01MTIAAAEAmaf15JI9/i
+XCpaxfqdD6xlsieFrxzGqWctg4NL6IsEq6GaXoWRO/WSf8P2pYDViWTTB63jtS1IEkMADQ
+bWfNQ8UVmOKkNVJ6N3WVmcLzCKuKOmMD/RHn1+fIlziOuRRYvuSPnKsPzZeUmJYqKKFoKt
+Nqa0huG2QQOE/egQgM2Qsx5XFO2bY2LvWm27MYAPnXR8DW+t6TjGjH5VsjoYOLM35d7Uy4
+QLrOUrJ9yuwGyu+P1YBXfW7rkSSPompuhKoYeF1xIl+yZtlo/6WssnPea+ead/X+djGuOz
+pXlPnAmXWROsC2+CucEfeyRP+y5EubXquvJX1IZcyqsiZUrEnFXg==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ecdsa-384-no-options-individual.sig
+++ b/spec/fixtures/signatures/message.ecdsa-384-no-options-individual.sig
@ -0,0 +1,8 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAIgAAAATZWNkc2Etc2hhMi1uaXN0cDM4NAAAAAhuaXN0cDM4NAAAAG
+EEBWKUksRLswAwMd2AE7ngA0mFNzkQNVksZv9A7wX0/IkJ7B0bqsthw3TT4GUNEcmLIi/T
+gsDjWYytz/+pgyKzA2cmFGMpTHFHf7bBXZXbDYTA08mxlZpyRVkCtY51O6nVAAAABGZpbG
+UAAAAAAAAABnNoYTUxMgAAAIQAAAATZWNkc2Etc2hhMi1uaXN0cDM4NAAAAGkAAAAxAO1N
+k3gICmClPXQYFJFQ2MvU1jxYWeq2OiOX+cdtSF39yeUMN+Iac7xOMhufY89MwQAAADAnZ6
+VogqzdjnmvkgbVqr7PLLpghrzEjUOL1U3efkGVdpjmctLzz+NvHSJxVj1sS0c=
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ecdsa-521-no-options-individual.sig
+++ b/spec/fixtures/signatures/message.ecdsa-521-no-options-individual.sig
@ -0,0 +1,10 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAKwAAAATZWNkc2Etc2hhMi1uaXN0cDUyMQAAAAhuaXN0cDUyMQAAAI
+UEAW9JRz+TxQvrkcb0k4vWS9vZ6hqhvkMws8vBrxerO0uYRW/TxF9kr2wGW0NM3q59zG1h
+eiiyctgtBk/G8vwenQVkAIuwT56uu1/itlIAGWUrTUIuxdfVgUwtUSs7ojF1V08FCUa/GZ
+CWow9+o6wQ9dCaiBj+ROm5/K/VrueTfJSiPusKAAAABGZpbGUAAAAAAAAABnNoYTUxMgAA
+AKcAAAATZWNkc2Etc2hhMi1uaXN0cDUyMQAAAIwAAABCARSgT1SsUfLupThfDo/JlV5SJf
+NLzVPD3fQ/ZCjeUwCDt1UvpI4eV/sGPdPKvVSizBH2A3q1KlhKPV/L4Tjd8Ur3AAAAQgEh
+ibx70bgUzXxhPIE8p6w49k+1HEqyTFOCMU2IQy+811OpAekSWdRwP/fEMzK3bhBliWEv3t
+lnBj5U7aHVIZUXYQ==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ecdsa-sk-256-ed25519-sk-256-leaf-no-options-certificate.sig
+++ b/spec/fixtures/signatures/message.ecdsa-sk-256-ed25519-sk-256-leaf-no-options-certificate.sig
@ -0,0 +1,14 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAbkAAAAjc2stc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb2
+0AAAAg5RR5fx4uXRuq05PDyVulMskjIyoSdylg0M945q/84gwAAAAgGfkGrTZGFqJpaJZi
+nbvkxpKiN9upZp2nn7D+l8GlwaoAAAAEc3NoOgAAAAAAAAAAAAAAAQAAABNvY3RvY2F0QG
+V4YW1wbGUuY29tAAAAAAAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAB/AAAAInNr
+LWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBL/WxN
+aEGP9UbW8QOCJGVWrULn38X4N2O72cjreQZn1zqR/QAMdUJT5fZcy96itn954E6YQqSkXN
+BX2cv3YAIfEAAAAEc3NoOgAAAHgAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3
+NoLmNvbQAAAEkAAAAgQP2EJCwTdlrsEx1c50wAMeeZbiIA+e1ouUSYQG3KKJQAAAAhAIci
+NITxeaV5hsyeeLw5vB2kYk/HZ1D6ULGO4kT2XVeVAQAAACsAAAAEZmlsZQAAAAAAAAAGc2
+hhNTEyAAAAZwAAABpzay1zc2gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAAEC5nJCjxarZtXgH
+3DhCG3cuYDZabnr4CwClso7W7Bj070je8+fdlYhDol5C+jfgmoekwsY85jf5Mf6z9HOQgS
+IKAQAAAAw=
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ecdsa-sk-256-no-options-individual.sig
+++ b/spec/fixtures/signatures/message.ecdsa-sk-256-no-options-individual.sig
@ -0,0 +1,8 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAH8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQ
+AAAAhuaXN0cDI1NgAAAEEEqmXr/vvvgktMMMxJWNlbmlghHUPqkFdwTWbqH5SyqlDhj2ci
+sv0d/5FWWmg5o7P6QqGK67ZP5TaKudK3cz9IMgAAAARzc2g6AAAABGZpbGUAAAAAAAAABn
+NoYTUxMgAAAHgAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQAAAEkA
+AAAgDcAtC0bAgIYqAppznP6nXvxG1r4BO6/DUTqVv69kd/8AAAAhAMCArBS+p0XDf6K3Jt
+iu6gVyQXcC9PFIaIYfODSRtRpMAQAAAAM=
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ecdsa-sk-256-no-touch-required-individual.sig
+++ b/spec/fixtures/signatures/message.ecdsa-sk-256-no-touch-required-individual.sig
@ -0,0 +1,8 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAH8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQ
+AAAAhuaXN0cDI1NgAAAEEE7zLW+kMQAxFhjJyz3zpyuxxvJC9G3v6MnFerzcsz1HuEP3L2
+Ih3R/D03i7eHfI85fV2Exbdnf+QMlDoMSjwG6AAAAARzc2g6AAAABGZpbGUAAAAAAAAABn
+NoYTUxMgAAAHgAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQAAAEkA
+AAAgYZ7NpGEwp+StzjZivnhGR9UmiAb1RhIzhjNqynbt7F8AAAAhALXS+/eahRENNN4w5j
+UP4bM1Net1EBN4bF0VTJBydiPLAAAAAAY=
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ecdsa-sk-256-rsa-2048-leaf-no-options-certificate.sig
+++ b/spec/fixtures/signatures/message.ecdsa-sk-256-rsa-2048-leaf-no-options-certificate.sig
@ -0,0 +1,21 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAApMAAAAcc3NoLXJzYS1jZXJ0LXYwMUBvcGVuc3NoLmNvbQAAACDWcd
+m0R+TQ8fstdCKX+XuCOuR5jrdT/LNkf1CjpzCzkwAAAAMBAAEAAAEBAOmnPQZnKfEHVvR9
+ZBdYiWew3ulnbdruR0mq3r268k2th9fItOWg/Npg/mEE5MmL/0QvLJsoICEFpUXTm5jJcO
+zzL5gGhf4j+QH2fqlYvSqnv1ocfIaLVACdyB/DUk9niQO2mz5jdfe4M9+erFP/NMDEctYE
+OLfkV1I9fw7PPmXcFfrlXDl3wnQYrWAAq0r5qoEz0IFmrrbxVFRQhVKffTLuI/9YCqzxyy
+53TFcDug6BP5JalfFG0HT8JWKd2cgwF1+Y+4siwChPCXb7XagG5qzi1cXfW7mjXjqxBuC6
+gb3JSOPGjl5HQLZZbB3MFisMKpelfZCePDjC0bhDp+7gIx0AAAAAAAAAAAAAAAEAAAATb2
+N0b2NhdEBleGFtcGxlLmNvbQAAAAAAAAAAAAAAAP//////////AAAAAAAAAAAAAAAAAAAA
+fwAAACJzay1lY2RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AA
+AAQQS/1sTWhBj/VG1vEDgiRlVq1C59/F+Ddju9nI63kGZ9c6kf0ADHVCU+X2XMveorZ/ee
+BOmEKkpFzQV9nL92ACHxAAAABHNzaDoAAAB5AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNT
+ZAb3BlbnNzaC5jb20AAABKAAAAIQCN9Ty2RueT8N4hI5eZG6CFJ2ouopgLaRInTWpwr8pC
+BwAAACEA/oF95fsvJNJFKPJNNyV0eMEFqnMWNvYPcVHH/cJZDpsBAAAACwAAAARmaWxlAA
+AAAAAAAAZzaGE1MTIAAAEUAAAADHJzYS1zaGEyLTUxMgAAAQCRw4PJk5mH3E6pjNoxNnwO
+emUE/M02TugCWhxScuWg7b91Vy8w9ZwJVg1iV/cjespTlO4Rb5DRaVM2z1MyMk9+lo1hs
+kPdkrJujCFbfGEbz+JiC0hcdDetHDeWhtqKWXVio6wwuHk3x0SIsgr6AqLfbGs2Xw6rCbY
+y69C9XF86y3mlYUOnyRJDBHJsPUmPr1cY5bLItNa1wxTiQc3eMjYMCRLHI9GnkxL6s8UB7
+ToRRrfi6P16plJOTgg5J/dP1jP2ljBDrMolvId6AD6XLhqckPx6/mfUX0XfkupO5R378cR
+TtRlfhDeL49ReV0F6aY+aJ27jX8tkODIxkwkGoBq
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ecdsa-sk-256-verify-required-individual.sig
+++ b/spec/fixtures/signatures/message.ecdsa-sk-256-verify-required-individual.sig
@ -0,0 +1,8 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAH8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQ
+AAAAhuaXN0cDI1NgAAAEEECQFNMjgiFRfejK3WZs5uJC248i2CbBq4Eew7UvUc91dRSXf1
+WxT7KNJN9b87/faSlHwvvu5WfBM3j2RLedB56gAAAARzc2g6AAAABGZpbGUAAAAAAAAABn
+NoYTUxMgAAAHcAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQAAAEgA
+AAAgJzZkJ3IhcBmiZOIdw2/aOYrNhullyhYPLyHilvkBrzQAAAAgHjEuZBWCpw0E5zjfGH
+r8sxFBt3zNP0AI4cFTXF6IyOoFAAAACA==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ed25519-256-no-options-individual.sig
+++ b/spec/fixtures/signatures/message.ed25519-256-no-options-individual.sig
@ -0,0 +1,6 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAg1e4R+AkU+ybCVIxGNtxRduHsr4
+DBD+BHDa6XY30FXLAAAAAEZmlsZQAAAAAAAAAGc2hhNTEyAAAAUwAAAAtzc2gtZWQyNTUx
+OQAAAECNB7S7IXSAnSICBpoukqX+YS35dT6FcJ/d5sdYWbXnUqNs1FE9Qiplu7jrZtPYHz
+FFDA2+1k10/McMOEbbRgQL
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ed25519-sk-256-ecdsa-sk-256-leaf-no-options-certificate.sig
+++ b/spec/fixtures/signatures/message.ed25519-sk-256-ecdsa-sk-256-leaf-no-options-certificate.sig
@ -0,0 +1,14 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAagAAAArc2stZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcG
+Vuc3NoLmNvbQAAACAIi4TemoYKCSOKa2fucOEm4OhQrBvoVZYOFK3A4UCIbgAAAAhuaXN0
+cDI1NgAAAEEEir23xcSicFatKV8wnW+UTKnJTRoyUxItOtMIaNHHgat5Hxb11tY1wUiZKb
+61/LY3CQA/abMVtvGtw600QNU4DQAAAARzc2g6AAAAAAAAAAAAAAABAAAAE29jdG9jYXRA
+ZXhhbXBsZS5jb20AAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAEoAAAAac2
+stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgX18TowhM9BVz+xj2z/ogxEsCUw3jwInE
+/MurYa1/HfYAAAAEc3NoOgAAAGcAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAA
+BAKn4tO+67nkKBTUZDNHuJVgrw1ftIGkmnBkgWmjm5tH6BceKisyOV1syozC5oJuGKXPrT
+AlUxN6jcGRWzFhKmAAEAAAAuAAAABGZpbGUAAAAAAAAABnNoYTUxMgAAAHkAAAAic2stZW
+Nkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQAAAEoAAAAhAPWSglmWmTRuJy3al+ZF
+DLxqPB8Ws8sPn3+xcVfriCB3AAAAIQDEUTS4VjN6ydzLcAGAmdzwuPEOFhBg7+S5uS40qX
+33VwEAAAAM
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ed25519-sk-256-no-options-individual.sig
+++ b/spec/fixtures/signatures/message.ed25519-sk-256-no-options-individual.sig
@ -0,0 +1,7 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAEoAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgI5DSOR
+5Z6/GviRB8dJEIo4boF2Obt40vHGfYoETcfa0AAAAEc3NoOgAAAARmaWxlAAAAAAAAAAZz
+aGE1MTIAAABnAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAQI6rE/YbhO8wiS
+IrSyYzruE45lLkZwVykCV3gE1y3EiI/OF+E9TOPmn2GBrk2YBd/Tr+zrc+NQXOBhNq7r2p
+OgIBAAAABQ==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ed25519-sk-256-no-touch-required-individual.sig
+++ b/spec/fixtures/signatures/message.ed25519-sk-256-no-touch-required-individual.sig
@ -0,0 +1,7 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAEoAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgWuoTQN
+IuCB+4cT5HRWu7gIy9znEIPnrJGSnXFvJwOtcAAAAEc3NoOgAAAARmaWxlAAAAAAAAAAZz
+aGE1MTIAAABnAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAQPUJkLKAU9rAKV
+vht7EOABhf3gfTqoTDP9rhGg+2csEzq1qOrI7yNK9uEQU3ab2gJUtjAjeWDENllPcegxr/
+MwYAAAAAAw==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ed25519-sk-256-rsa-2048-leaf-no-options-certificate.sig
+++ b/spec/fixtures/signatures/message.ed25519-sk-256-rsa-2048-leaf-no-options-certificate.sig
@ -0,0 +1,20 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAkwAAAAcc3NoLXJzYS1jZXJ0LXYwMUBvcGVuc3NoLmNvbQAAACAc0l
+f//UYZfjR8N3k6PSbJIaY1rwLo4hmIOTjTovsn5wAAAAMBAAEAAAEBAMyTqmTZSy0JikDy
+LNRoED6F3znkfV79aolWdLCbhFGaR1yPc+Mk6cLXl8yqvfpTXbrp196cHD4VaLRnYaNC2Z
+cIddGunIBUoV9JIgCYAjErsVzzfOZz2qGaugX8ic+oML9AR2JTogubpbUMBZCIcSIH4TbX
+AX2zJrjR14UzC1/fjR3ezBop/vgMlZZVa6A1fgIfp7PLj+aU1v8sq6+pV3tho7ukqSbq8C
+8FW0rPY8G372e283mgsDghR/3mkopgenJzyHQt2RUI/9oeKrtzAOZEesQ6CwPE5zRmEUkW
+OnHKcuEbI4JmGYMccG5WRAuocvkcWi3CJXHq4rlSZiSGH+sAAAAAAAAAAAAAAAEAAAATb2
+N0b2NhdEBleGFtcGxlLmNvbQAAAAAAAAAAAAAAAP//////////AAAAAAAAAAAAAAAAAAAA
+SgAAABpzay1zc2gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACBfXxOjCEz0FXP7GPbP+iDESw
+JTDePAicT8y6thrX8d9gAAAARzc2g6AAAAZwAAABpzay1zc2gtZWQyNTUxOUBvcGVuc3No
+LmNvbQAAAEDsKXCpZHUjMAoF/Fb6hepeARxCbPweYFU442boUX8fdCkROl0Py9QUJoJZwr
+YZTN94P88F6X5huG1clbUxHMAKAQAAAAgAAAAEZmlsZQAAAAAAAAAGc2hhNTEyAAABFAAA
+AAxyc2Etc2hhMi01MTIAAAEAgxqAU9JzwaFlwE1eZCeeTb3U4+wYw8BOu56aDoMYYWEEop
+A6HkIOc7Jib0p99ExvkbG3zjC6YeX3wzk6JD+8lp3DL+WHE+LNRWyDHvwWADgrKxoEtMMb
+/+gGz+fPZ/NccLHws6Hg9vRbv6rv1vnX4Z9L6JZqUL6S0w0xjUKE4Y8AhUbfPfedu7poQZ
+167xROT+5Gb+OdpWlhRTqkm+j90cRAMS8Mf56py5ndimuBYzyrbB6iR0398UEvr7TuMtQh
+mRx0A4fdCKITu7A2xjQtBVmbi+BQARIm2c+vwrZpT/ORN9VlwA+F0qIFD3NEQd7f+rSGF+
+E/KGql1eYLG/W6zg==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.ed25519-sk-256-verify-required-individual.sig
+++ b/spec/fixtures/signatures/message.ed25519-sk-256-verify-required-individual.sig
@ -0,0 +1,7 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAEoAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgKu4u1m
+52xSrQl4HLKs1EZGeFFUyhrztxVJaWJ5zZhIsAAAAEc3NoOgAAAARmaWxlAAAAAAAAAAZz
+aGE1MTIAAABnAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAQImvPYiSwTUeGo
+m00JQZwoy4AvGtq7KNDFTnT1PQVuxoKn6UrcWcyUKSFHUfodjN/Tmb87ViyHDhGjsjRIdH
+iA4FAAAABw==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.rsa-2048-ecdsa-256-leaf-no-options-certificate.sig
+++ b/spec/fixtures/signatures/message.rsa-2048-ecdsa-256-leaf-no-options-certificate.sig
@ -0,0 +1,20 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAxcAAAAoZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcGVuc3
+NoLmNvbQAAACAB+DkCXFG3I/70j/PZIr5v55+BeODCyyqvKypsGiYJLgAAAAhuaXN0cDI1
+NgAAAEEEjizw6toloNLWI5Cbvc31Auwtg8N69+VZyHJTiicTuhTsLgEtj+TWbPVqCeK751
+AUARcqpzmB3dYMQ+ti2qoiPQAAAAAAAAAAAAAAAQAAABNvY3RvY2F0QGV4YW1wbGUuY29t
+AAAAAAAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAEXAAAAB3NzaC1yc2EAAAADAQ
+ABAAABAQDBVcd8deev1PKbO0GCYgK2RByIn9eac4lWgexAfWT0WsJZ2p9ZRuPLT11KWCcG
+ZULSLPMgI1B4kHfr4NkMChayajeeURULtV3PWM8Vtd49Op11+SnUk6LuDes27lKjMIMLKt
+PRkUE0/f7o1gTIQ6rExrNC8m1qm0VRuWvn6OmSwujdSSyJlrq3TjKAxl/PMPnqw3duaoSz
+O0bKV+xhqmWvESbVsgb10i4L7vEE/4Dvc45FpyNQbd/VNB+3uTLaF11P3vxvo/Qau+YuW+
+p4UIoLHPnaaynYw37UBfeFidrtW81gLX1gle3qQI4TF+JQERuqaUZxR7qvhKyHxQblDkWT
+AAABFAAAAAxyc2Etc2hhMi01MTIAAAEAwCLljUsnNb5PV0BKstOxoRWq2HYwpBUbbptc4A
+Gb1eHo200ErALyggdK9NyRxAhQwJMJOEvMei03KsJ9rWi4ghlQxo5XH5cUg3VL6a0dSW4r
+79z0YkhjWyJoNcKrSWC214KCd5X5ybnbtt91fqtZFT/fpvqdnI1lppJgg5mQOpdolhjGO7
+FLSflpECMqnjQQeOVmJQVSzgRgm6MN52keXTBNtKUR5UiGYSjveSguyXkHp5/z8BBbTGUV
+lmEuQrb+Sg2BcnRE7hG1l98plYnGEzU0JNWEJAepWTH4N22q9jWFahZNgE8FzMhO9q2F/9
+Wf7Sd8QUiKnsmKaogH4MdMkgAAAARmaWxlAAAAAAAAAAZzaGE1MTIAAABkAAAAE2VjZHNh
+LXNoYTItbmlzdHAyNTYAAABJAAAAIQCAGJUieJd1JsDrgWqEW3LmE5+Cj24zKO09WUnEmx
+WrrQAAACB88Pg0UkZug3TVcKQgT1oClkJhqK83kZaHjP/bTKk7Gg==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.rsa-2048-ecdsa-sk-2048-leaf-no-options-certificate.sig
+++ b/spec/fixtures/signatures/message.rsa-2048-ecdsa-sk-2048-leaf-no-options-certificate.sig
@ -0,0 +1,21 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAyIAAAArc2stZWNkc2Etc2hhMi1uaXN0cDI1Ni1jZXJ0LXYwMUBvcG
+Vuc3NoLmNvbQAAACAjR5U36ps13d0rwY955LBUXrm5/Mn4wMyQ3ymhrGJ40gAAAAhuaXN0
+cDI1NgAAAEEE/4o4GdGw6meqNQgXD98Hpqvu/w/zQoEP8lVfpLOsvYDMEJbLRMJedk57/s
+10rRz1xmHUedDsoRCr9Ivu0FWKvAAAAARzc2g6AAAAAAAAAAAAAAABAAAAE29jdG9jYXRA
+ZXhhbXBsZS5jb20AAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAARcAAAAHc3
+NoLXJzYQAAAAMBAAEAAAEBAMFVx3x156/U8ps7QYJiArZEHIif15pziVaB7EB9ZPRawlna
+n1lG48tPXUpYJwZlQtIs8yAjUHiQd+vg2QwKFrJqN55RFQu1Xc9YzxW13j06nXX5KdSTou
+4N6zbuUqMwgwsq09GRQTT9/ujWBMhDqsTGs0LybWqbRVG5a+fo6ZLC6N1JLImWurdOMoDG
+X88w+erDd25qhLM7RspX7GGqZa8RJtWyBvXSLgvu8QT/gO9zjkWnI1Bt39U0H7e5MtoXXU
+/e/G+j9Bq75i5b6nhQigsc+dprKdjDftQF94WJ2u1bzWAtfWCV7epAjhMX4lARG6ppRnFH
+uq+ErIfFBuUORZMAAAEUAAAADHJzYS1zaGEyLTUxMgAAAQBoDXu6nTtkgGWVEVpF1CMwUE
+jS0dMKe3TwR/o2MB7KzU115hIGADFw4ccucbEBf7yDcDlPQLA8qz2qIqqI31C5O/eJaVt3
+R2ozDKpic8kR8eLtl15biHTLl+2gO26pw1Xj+Bgp8Y2u7VWHeyPXyJEHnkWN6Z7fgOnErh
+krl4AFdZpJqlO5kBYcfD5VEICLAlTKPcMvTJMsTNonajgAeNDKUnYTEYjRvcqiACucQ4L7
+Bwb2XorQi0bXIjQ/ROdeDt5Boj92QzvcVF4s/qc2TcVLwRF293GqZYyUNxPDgx/FlH3vVL
+c/mWsH9Y3Q97VD9dTJUeemJe9c7rw2LGzDmJ6IAAAABGZpbGUAAAAAAAAABnNoYTUxMgAA
+AHcAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQAAAEgAAAAgcBNFLL
+XaXWFHJMrO+1g/uc3jEmriFo78/3fKifpyhUgAAAAgPzYCXVLASoF2t4syOA6QDu80/PCP
+aEsOHQOCfXw+Ps0BAAAACQ==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.rsa-2048-ed25519-sk-2048-leaf-no-options-certificate.sig
+++ b/spec/fixtures/signatures/message.rsa-2048-ed25519-sk-2048-leaf-no-options-certificate.sig
@ -0,0 +1,20 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAu0AAAAjc2stc3NoLWVkMjU1MTktY2VydC12MDFAb3BlbnNzaC5jb2
+0AAAAg0Kdphy7ZVA59xWQvQ6nN3teTfe7Xk3i/icBw9ZFOinwAAAAgd5guDCNz+m3ln1ij
+3QIggE8vhaPvhpp5lWNQdYf+34QAAAAEc3NoOgAAAAAAAAAAAAAAAQAAABNvY3RvY2F0QG
+V4YW1wbGUuY29tAAAAAAAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAEXAAAAB3Nz
+aC1yc2EAAAADAQABAAABAQDBVcd8deev1PKbO0GCYgK2RByIn9eac4lWgexAfWT0WsJZ2p
+9ZRuPLT11KWCcGZULSLPMgI1B4kHfr4NkMChayajeeURULtV3PWM8Vtd49Op11+SnUk6Lu
+Des27lKjMIMLKtPRkUE0/f7o1gTIQ6rExrNC8m1qm0VRuWvn6OmSwujdSSyJlrq3TjKAxl
+/PMPnqw3duaoSzO0bKV+xhqmWvESbVsgb10i4L7vEE/4Dvc45FpyNQbd/VNB+3uTLaF11P
+3vxvo/Qau+YuW+p4UIoLHPnaaynYw37UBfeFidrtW81gLX1gle3qQI4TF+JQERuqaUZxR7
+qvhKyHxQblDkWTAAABFAAAAAxyc2Etc2hhMi01MTIAAAEAgG2xKVu2dWWLDc9X8tuVYXax
+wQ2+AH7N2ql//yNCMvxA4P/5IdJXz0xE+5/DH6ZYjjzqKV07RdHg+CvawxqEe1c6TRDmZa
+m3p9Z5D3/3j8jdtsQotYpxhYQDbQJOs+41wmVz+PoVo8FsZEK95j5IcSo+WaoVS/mKMEx/
+IKw8Cfk1b1RdeaWZd/E7/CmnATSjpZN3vfIkRpNi821Jl1e1CMedC7/Nu64G/zqo68jiuK
+jLc3LklA66+X3ZxtZjQo5qxahMPoTCpx3JlzyhdgFgsmAH+zsf1JHAb0tZohFHgKMU8/NL
+HtlqG8g5W1S11sOX/hVAQqS3txHv64Ox/uAr2gAAAARmaWxlAAAAAAAAAAZzaGE1MTIAAA
+BnAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAQHX5z7SbtWc9/yklinLY0Nog
+Zaqb53s2jbIKIraIaKtE4NtjHPtg0F/ukkGC6IxCb1SVi6QvHZlkWit2yPFfiQEBAAAACQ
+==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/message.rsa-2048-no-options-individual.sig
+++ b/spec/fixtures/signatures/message.rsa-2048-no-options-individual.sig
@ -0,0 +1,14 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAARcAAAAHc3NoLXJzYQAAAAMBAAEAAAEBAJVqMcQZ1IJrn2DpuZzniW
+JNF5fOsd9lbXoQky2cYZwn5Jnp7seZkMXcFjl9pd1YodEict7eWKXm2JhWvwSvVS5MlWOm
+r3O1bsNgm7HpMdVILakWwtQkQHSXWTwT5AfQDfG0djrfXEeNM1SdyFwr3i7CzEzvIWgz1s
+8Zw7EF1GoaCaf3yVqhlk0e4jOctCQa8zSSkr8eLjvg7VWohGldf3/RcHDKbV9GtXTnSoIZ
+PEebgFZDaDkvySZ+9Kwzz7yd1bWGEoV0xqj252Tr+GDknXQKhTdfzyqPzWK0Bjqpa15KfT
+SW5sxlACIm256vC6Y80uwcxuQ7RkqYNqPKvXBL4R0AAAAEZmlsZQAAAAAAAAAGc2hhNTEy
+AAABFAAAAAxyc2Etc2hhMi01MTIAAAEAdTvGjLZUEsbEohKD58Dt4qc7j+CapyYVBYajmp
+cnObDo4BCbcIxHektuNscsVrheB74JDuxWHW/WnSAMlhPi5P8TeB/RmR98RO/Vpyl/fEpk
+Sf7zHNKIzhQGRMXX36ysvkOxmQPOBggfqix1CwK2DElH3fSbLUznu8wiDho6P8mM82NzQT
+Y0Vc2Bixfj7vdIItVy1Z390dfiny3OOAWvo5BzI6iHWUKnvuZ7Rm+K4oApawS29zNy2pEa
+yksEze4TMTu7tW5kpC6UJ3M/VhNtRiBe0sbmy2UsqxbRW/6sYFyjyB9/3RjXwJWIVfMu0n
+B6PO/Fr2E+NC1CjwKClIAgmw==
+-----END SSH SIGNATURE-----
--- a/spec/fixtures/signatures/rsa-2048-ca-no-options-certificate.key
+++ b/spec/fixtures/signatures/rsa-2048-ca-no-options-certificate.key
@ -0,0 +1,27 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAQEAwVXHfHXnr9TymztBgmICtkQciJ/XmnOJVoHsQH1k9FrCWdqfWUbj
+y09dSlgnBmVC0izzICNQeJB36+DZDAoWsmo3nlEVC7Vdz1jPFbXePTqddfkp1JOi7g3rNu
+5SozCDCyrT0ZFBNP3+6NYEyEOqxMazQvJtaptFUblr5+jpksLo3UksiZa6t04ygMZfzzD5
+6sN3bmqEsztGylfsYaplrxEm1bIG9dIuC+7xBP+A73OORacjUG3f1TQft7ky2hddT978b6
+P0GrvmLlvqeFCKCxz52msp2MN+1AX3hYna7VvNYC19YJXt6kCOExfiUBEbqmlGcUe6r4Ss
+h8UG5Q5FkwAAA7h0YpBedGKQXgAAAAdzc2gtcnNhAAABAQDBVcd8deev1PKbO0GCYgK2RB
+yIn9eac4lWgexAfWT0WsJZ2p9ZRuPLT11KWCcGZULSLPMgI1B4kHfr4NkMChayajeeURUL
+tV3PWM8Vtd49Op11+SnUk6LuDes27lKjMIMLKtPRkUE0/f7o1gTIQ6rExrNC8m1qm0VRuW
+vn6OmSwujdSSyJlrq3TjKAxl/PMPnqw3duaoSzO0bKV+xhqmWvESbVsgb10i4L7vEE/4Dv
+c45FpyNQbd/VNB+3uTLaF11P3vxvo/Qau+YuW+p4UIoLHPnaaynYw37UBfeFidrtW81gLX
+1gle3qQI4TF+JQERuqaUZxR7qvhKyHxQblDkWTAAAAAwEAAQAAAQBQn7b6/ihKOSGa/pEJ
+EFpVK/5CM3Yz4K6LNs8Q7bnl9NtLoVIGZvuj00ryL+TGVAATqc8RvehW/tgjs7aPwL1KVe
+Uvzlxab53ZVA233gn5urHjeq6pCZBOedt3ItevWhGr3IZMxKhOswVUj7ua0C0stjgXWQWs
+CWhU9mA7a/PL0WZzRhMgs9Im/H8Mmk5zpTrwLg7RWGu28Ei4ib4Xx8gngvaAd/skv6lcWk
+PlLfVTcVFYo/HqCe/DuCLnl/Ln3koc67UxNvy/8mp6KgEGONDHiHtXAVq0rmQ1O51PpQM2
+pQWGoXFPvyHcdV47Vjg05/HCORmYdlvpH4hW3QoS3SXhAAAAgQDK+6q5rIap3J/p+/3rOw
+TX+By6shYkbekpiImgM23StI3jw5TZ5AIsIInoU68tYxcpbSXZooUJANj+VlidGcY/E01D
+pa59hfPEmu/VJolEGZTEtXVN5P5Vf3QHBLSF6WZDd8umn2L3MHfUQN6QeRMoAf0VUhh3lm
+L98uKDjF27LwAAAIEA65trR2tnJb1CPc8P8kFxn2oYpkZ9BLwex5pLn1+DltJQhAn2GE5E
+Hkw2xGSxsXzfRaG2aqSADeCD2IafacD6t+vaO6MK7SJAEPcp9pGJwcfoyroUY9QzY71/4R
+wbJOWsuwlfsHVAyGot0CkLSVvZlhwK2PuzB3tvvMuHXT2anosAAACBANIRsl9GZhvMN5/b
+O7ESSx9T09XJ8kksomRQwNWaN3HHnC3wQsh8jYkzhIqGsinh1ZoPB8vkkDCCbk9TK3wHNb
+GOc+adT718t08v6/0naQcrAaZ8QpmGNel74FfDUKwkRQ3rzhT/HI4FZDpuuBe8Lp3oo9Hq
+Qa+q5eG39OQfsZ4ZAAAAAAEC
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/rsa-2048-ca-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/rsa-2048-ca-no-options-certificate.key.pub
@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBVcd8deev1PKbO0GCYgK2RByIn9eac4lWgexAfWT0WsJZ2p9ZRuPLT11KWCcGZULSLPMgI1B4kHfr4NkMChayajeeURULtV3PWM8Vtd49Op11+SnUk6LuDes27lKjMIMLKtPRkUE0/f7o1gTIQ6rExrNC8m1qm0VRuWvn6OmSwujdSSyJlrq3TjKAxl/PMPnqw3duaoSzO0bKV+xhqmWvESbVsgb10i4L7vEE/4Dvc45FpyNQbd/VNB+3uTLaF11P3vxvo/Qau+YuW+p4UIoLHPnaaynYw37UBfeFidrtW81gLX1gle3qQI4TF+JQERuqaUZxR7qvhKyHxQblDkWT 
--- a/spec/fixtures/signatures/rsa-2048-ecdsa-256-leaf-no-options-certificate.key
+++ b/spec/fixtures/signatures/rsa-2048-ecdsa-256-leaf-no-options-certificate.key
@ -0,0 +1,8 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSOLPDq2iWg0tYjkJu9zfUC7C2Dw3r3
+5VnIclOKJxO6FOwuAS2P5NZs9WoJ4rvnUBQBFyqnOYHd1gxD62LaqiI9AAAAoER2NnJEdj
+ZyAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBI4s8OraJaDS1iOQ
+m73N9QLsLYPDevflWchyU4onE7oU7C4BLY/k1mz1agniu+dQFAEXKqc5gd3WDEPrYtqqIj
+0AAAAhAIIbq5l02+wXVqlTaF1UlhPlw9QDCORIAUGRHJlNCDnOAAAAAAECAwQFBgc=
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/rsa-2048-ecdsa-256-leaf-no-options-certificate.key-cert.pub
+++ b/spec/fixtures/signatures/rsa-2048-ecdsa-256-leaf-no-options-certificate.key-cert.pub
@ -0,0 +1 @@
+ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAKGVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgAfg5AlxRtyP+9I/z2SK+b+efgXjgwssqrysqbBomCS4AAAAIbmlzdHAyNTYAAABBBI4s8OraJaDS1iOQm73N9QLsLYPDevflWchyU4onE7oU7C4BLY/k1mz1agniu+dQFAEXKqc5gd3WDEPrYtqqIj0AAAAAAAAAAAAAAAEAAAATb2N0b2NhdEBleGFtcGxlLmNvbQAAAAAAAAAAAAAAAP//////////AAAAAAAAAAAAAAAAAAABFwAAAAdzc2gtcnNhAAAAAwEAAQAAAQEAwVXHfHXnr9TymztBgmICtkQciJ/XmnOJVoHsQH1k9FrCWdqfWUbjy09dSlgnBmVC0izzICNQeJB36+DZDAoWsmo3nlEVC7Vdz1jPFbXePTqddfkp1JOi7g3rNu5SozCDCyrT0ZFBNP3+6NYEyEOqxMazQvJtaptFUblr5+jpksLo3UksiZa6t04ygMZfzzD56sN3bmqEsztGylfsYaplrxEm1bIG9dIuC+7xBP+A73OORacjUG3f1TQft7ky2hddT978b6P0GrvmLlvqeFCKCxz52msp2MN+1AX3hYna7VvNYC19YJXt6kCOExfiUBEbqmlGcUe6r4Ssh8UG5Q5FkwAAARQAAAAMcnNhLXNoYTItNTEyAAABAMAi5Y1LJzW+T1dASrLTsaEVqth2MKQVG26bXOABm9Xh6NtNBKwC8oIHSvTckcQIUMCTCThLzHotNyrCfa1ouIIZUMaOVx+XFIN1S+mtHUluK+/c9GJIY1siaDXCq0lgtteCgneV+cm527bfdX6rWRU/36b6nZyNZaaSYIOZkDqXaJYYxjuxS0n5aRAjKp40EHjlZiUFUs4EYJujDedpHl0wTbSlEeVIhmEo73koLsl5B6ef8/AQW0xlFZZhLkK2/koNgXJ0RO4RtZffKZWJxhM1NCTVhCQHqVkx+DdtqvY1hWoWTYBPBczITvathf/Vn+0nfEFIip7JimqIB+DHTJI= ./rsa-2048-ecdsa-256-leaf-no-options-certificate.key.pub
--- a/spec/fixtures/signatures/rsa-2048-ecdsa-256-leaf-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/rsa-2048-ecdsa-256-leaf-no-options-certificate.key.pub
@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBI4s8OraJaDS1iOQm73N9QLsLYPDevflWchyU4onE7oU7C4BLY/k1mz1agniu+dQFAEXKqc5gd3WDEPrYtqqIj0= 
--- a/spec/fixtures/signatures/rsa-2048-ecdsa-sk-2048-leaf-no-options-certificate.key
+++ b/spec/fixtures/signatures/rsa-2048-ecdsa-sk-2048-leaf-no-options-certificate.key
@ -0,0 +1,10 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2
+RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQT/ijgZ0bDq
+Z6o1CBcP3wemq+7/D/NCgQ/yVV+ks6y9gMwQlstEwl52Tnv+zXStHPXGYdR50OyhEKv0i+
+7QVYq8AAAABHNzaDoAAADYAFRkpgBUZKYAAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv
+cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEE/4o4GdGw6meqNQgXD98Hpqvu/w/zQoEP8l
+VfpLOsvYDMEJbLRMJedk57/s10rRz1xmHUedDsoRCr9Ivu0FWKvAAAAARzc2g6AQAAAED4
+fJTun4mlO2YLMB3jfAZikovsoJ47cpvSnISnsttZYzDt9A9N1rysrK5YhC+pRp3fh7dejW
+KxhA5Lu4BKQXsWAAAAAAAAAAABAgME
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/rsa-2048-ecdsa-sk-2048-leaf-no-options-certificate.key-cert.pub
+++ b/spec/fixtures/signatures/rsa-2048-ecdsa-sk-2048-leaf-no-options-certificate.key-cert.pub
@ -0,0 +1 @@
+sk-ecdsa-sha2-nistp256-cert-v01@openssh.com AAAAK3NrLWVjZHNhLXNoYTItbmlzdHAyNTYtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgI0eVN+qbNd3dK8GPeeSwVF65ufzJ+MDMkN8poaxieNIAAAAIbmlzdHAyNTYAAABBBP+KOBnRsOpnqjUIFw/fB6ar7v8P80KBD/JVX6SzrL2AzBCWy0TCXnZOe/7NdK0c9cZh1HnQ7KEQq/SL7tBVirwAAAAEc3NoOgAAAAAAAAAAAAAAAQAAABNvY3RvY2F0QGV4YW1wbGUuY29tAAAAAAAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQDBVcd8deev1PKbO0GCYgK2RByIn9eac4lWgexAfWT0WsJZ2p9ZRuPLT11KWCcGZULSLPMgI1B4kHfr4NkMChayajeeURULtV3PWM8Vtd49Op11+SnUk6LuDes27lKjMIMLKtPRkUE0/f7o1gTIQ6rExrNC8m1qm0VRuWvn6OmSwujdSSyJlrq3TjKAxl/PMPnqw3duaoSzO0bKV+xhqmWvESbVsgb10i4L7vEE/4Dvc45FpyNQbd/VNB+3uTLaF11P3vxvo/Qau+YuW+p4UIoLHPnaaynYw37UBfeFidrtW81gLX1gle3qQI4TF+JQERuqaUZxR7qvhKyHxQblDkWTAAABFAAAAAxyc2Etc2hhMi01MTIAAAEAaA17up07ZIBllRFaRdQjMFBI0tHTCnt08Ef6NjAeys1NdeYSBgAxcOHHLnGxAX+8g3A5T0CwPKs9qiKqiN9QuTv3iWlbd0dqMwyqYnPJEfHi7ZdeW4h0y5ftoDtuqcNV4/gYKfGNru1Vh3sj18iRB55Fjeme34DpxK4ZK5eABXWaSapTuZAWHHw+VRCAiwJUyj3DL0yTLEzaJ2o4AHjQylJ2ExGI0b3KogArnEOC+wcG9l6K0ItG1yI0P0TnXg7eQaI/dkM73FReLP6nNk3FS8ERdvdxqmWMlDcTw4MfxZR971S3P5lrB/WN0Pe1Q/XUyVHnpiXvXO68Nixsw5ieiA== ./rsa-2048-ecdsa-sk-2048-leaf-no-options-certificate.key.pub
--- a/spec/fixtures/signatures/rsa-2048-ecdsa-sk-2048-leaf-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/rsa-2048-ecdsa-sk-2048-leaf-no-options-certificate.key.pub
@ -0,0 +1 @@
+sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBP+KOBnRsOpnqjUIFw/fB6ar7v8P80KBD/JVX6SzrL2AzBCWy0TCXnZOe/7NdK0c9cZh1HnQ7KEQq/SL7tBVirwAAAAEc3NoOg== 
--- a/spec/fixtures/signatures/rsa-2048-ed25519-sk-2048-leaf-no-options-certificate.key
+++ b/spec/fixtures/signatures/rsa-2048-ed25519-sk-2048-leaf-no-options-certificate.key
@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2
+gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACB3mC4MI3P6beWfWKPdAiCATy+Fo++GmnmVY1B1
+h/7fhAAAAARzc2g6AAAA4H+z659/s+ufAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2
+9tAAAAIHeYLgwjc/pt5Z9Yo90CIIBPL4Wj74aaeZVjUHWH/t+EAAAABHNzaDoBAAAAgK24
+UJr/fAlqqalXl98+xWiq61NB66u+mTIr0Msy9NANoMWDJqChaq2e4mZJUHcH5jiH8jdAHu
+wTc2wA6GF7NVivcLlLWu9mCAUWYoLZWZVTg4yZfqlLYTZFDYKl5w4vxpBx7+ZYdmC1MhAO
+6jLxV8J4Hg0wPEZXa9mJ9SGatA/NAAAAAAAAAAAB
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/rsa-2048-ed25519-sk-2048-leaf-no-options-certificate.key-cert.pub
+++ b/spec/fixtures/signatures/rsa-2048-ed25519-sk-2048-leaf-no-options-certificate.key-cert.pub
@ -0,0 +1 @@
+sk-ssh-ed25519-cert-v01@openssh.com AAAAI3NrLXNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAINCnaYcu2VQOfcVkL0Opzd7Xk33u15N4v4nAcPWRTop8AAAAIHeYLgwjc/pt5Z9Yo90CIIBPL4Wj74aaeZVjUHWH/t+EAAAABHNzaDoAAAAAAAAAAAAAAAEAAAATb2N0b2NhdEBleGFtcGxlLmNvbQAAAAAAAAAAAAAAAP//////////AAAAAAAAAAAAAAAAAAABFwAAAAdzc2gtcnNhAAAAAwEAAQAAAQEAwVXHfHXnr9TymztBgmICtkQciJ/XmnOJVoHsQH1k9FrCWdqfWUbjy09dSlgnBmVC0izzICNQeJB36+DZDAoWsmo3nlEVC7Vdz1jPFbXePTqddfkp1JOi7g3rNu5SozCDCyrT0ZFBNP3+6NYEyEOqxMazQvJtaptFUblr5+jpksLo3UksiZa6t04ygMZfzzD56sN3bmqEsztGylfsYaplrxEm1bIG9dIuC+7xBP+A73OORacjUG3f1TQft7ky2hddT978b6P0GrvmLlvqeFCKCxz52msp2MN+1AX3hYna7VvNYC19YJXt6kCOExfiUBEbqmlGcUe6r4Ssh8UG5Q5FkwAAARQAAAAMcnNhLXNoYTItNTEyAAABAIBtsSlbtnVliw3PV/LblWF2scENvgB+zdqpf/8jQjL8QOD/+SHSV89MRPufwx+mWI486ildO0XR4Pgr2sMahHtXOk0Q5mWpt6fWeQ9/94/I3bbEKLWKcYWEA20CTrPuNcJlc/j6FaPBbGRCveY+SHEqPlmqFUv5ijBMfyCsPAn5NW9UXXmlmXfxO/wppwE0o6WTd73yJEaTYvNtSZdXtQjHnQu/zbuuBv86qOvI4rioy3Ny5JQOuvl92cbWY0KOasWoTD6EwqcdyZc8oXYBYLJgB/s7H9SRwG9LWaIRR4CjFPPzSx7ZahvIOVtUtdbDl/4VQEKkt7cR7+uDsf7gK9o= ./rsa-2048-ed25519-sk-2048-leaf-no-options-certificate.key.pub
--- a/spec/fixtures/signatures/rsa-2048-ed25519-sk-2048-leaf-no-options-certificate.key.pub
+++ b/spec/fixtures/signatures/rsa-2048-ed25519-sk-2048-leaf-no-options-certificate.key.pub
@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHeYLgwjc/pt5Z9Yo90CIIBPL4Wj74aaeZVjUHWH/t+EAAAABHNzaDo= 
--- a/spec/fixtures/signatures/rsa-2048-no-options-individual.key
+++ b/spec/fixtures/signatures/rsa-2048-no-options-individual.key
@ -0,0 +1,27 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAQEAlWoxxBnUgmufYOm5nOeJYk0Xl86x32VtehCTLZxhnCfkmenux5mQ
+xdwWOX2l3Vih0SJy3t5YpebYmFa/BK9VLkyVY6avc7Vuw2Cbsekx1UgtqRbC1CRAdJdZPB
+PkB9AN8bR2Ot9cR40zVJ3IXCveLsLMTO8haDPWzxnDsQXUahoJp/fJWqGWTR7iM5y0JBrz
+NJKSvx4uO+DtVaiEaV1/f9FwcMptX0a1dOdKghk8R5uAVkNoOS/JJn70rDPPvJ3VtYYShX
+TGqPbnZOv4YOSddAqFN1/PKo/NYrQGOqlrXkp9NJbmzGUAIibbnq8LpjzS7BzG5DtGSpg2
+o8q9cEvhHQAAA7j2wpnT9sKZ0wAAAAdzc2gtcnNhAAABAQCVajHEGdSCa59g6bmc54liTR
+eXzrHfZW16EJMtnGGcJ+SZ6e7HmZDF3BY5faXdWKHRInLe3lil5tiYVr8Er1UuTJVjpq9z
+tW7DYJux6THVSC2pFsLUJEB0l1k8E+QH0A3xtHY631xHjTNUnchcK94uwsxM7yFoM9bPGc
+OxBdRqGgmn98laoZZNHuIznLQkGvM0kpK/Hi474O1VqIRpXX9/0XBwym1fRrV050qCGTxH
+m4BWQ2g5L8kmfvSsM8+8ndW1hhKFdMao9udk6/hg5J10CoU3X88qj81itAY6qWteSn00lu
+bMZQAiJtuerwumPNLsHMbkO0ZKmDajyr1wS+EdAAAAAwEAAQAAAQAN92U7fWad4k19k5tk
+DUiMRcSEzi9WQHbhSBdZ1hpRrHDz6igFxFcCB7aUHSiZ7iUCFYRDTOlgaJmqc8FbQMBnmY
+UFUZlo6Xa3EJq9IJ0l4J9UBOqlRdY4j8UplnpkOJB1HXdHvYU0swAvUqhd5UPZfx/1uQyY
+XvAfX7spGvBmEnBwb50IyaM1IeCNCiG8lfjEmQPkwPSlHeYyuEi0RxKoXKQ6ROpYI0EXTu
+lv6eNwZ5KNcFf4HR1pvls3BcK0/1NQWgGeDXAJBfmg503XzPgOot1+rUmYIADrdlespdZn
+V2njIfXVz/BQjbegLha82viORKaRMpYF31jwzefYIbHBAAAAgC7MgbfUruWjgNhbR+rjGl
+Duy/fBvsHHccBizQM/N50iC+nUHS1wCLM9DLA6LjUxng+Zh5HFZn9UpdCLN1O+BmGR//lu
+tyTPyaPXJxJ48lTEwmQRwZwf/JZyU4WGFyU8QP3yDRH29QmS0pRpSKZC6i1F4nf62ByW7d
+cAw/yiwMveAAAAgQDD/HAWCBjjTQdTvhFQsBH7mMYLAlFqPSRm4Jaj5chwixEs+oCwdhhq
+opLoKDn6EclHD/dvbDFDHgJI4mMfkumae/htIbV73QKXnQrm8uepRmnKQVwJXR5+6K5+Th
+WIql/uWjpa+z75AH//wZTGM2ujeyLwsOKXlrYJXdc/cs6LFQAAAIEAwyr8ED6dQnjRMma4
+/V/SQCFzFL5aNH0AFcSdujYyuzv9KtodwAr2k+3TpIKvus0jlsGe5/uAgebl8IP8k/cjSz
+OlzSufRy7+ex8DIwS6rqhdnI7DUpKe0CD1RO/GJ9s0o/m1rwNODnc8CdYCqfQf8MoaextP
+sEWAxjcJ8pSI3+kAAAAAAQID
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/signatures/rsa-2048-no-options-individual.key.pub
+++ b/spec/fixtures/signatures/rsa-2048-no-options-individual.key.pub
@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCVajHEGdSCa59g6bmc54liTReXzrHfZW16EJMtnGGcJ+SZ6e7HmZDF3BY5faXdWKHRInLe3lil5tiYVr8Er1UuTJVjpq9ztW7DYJux6THVSC2pFsLUJEB0l1k8E+QH0A3xtHY631xHjTNUnchcK94uwsxM7yFoM9bPGcOxBdRqGgmn98laoZZNHuIznLQkGvM0kpK/Hi474O1VqIRpXX9/0XBwym1fRrV050qCGTxHm4BWQ2g5L8kmfvSsM8+8ndW1hhKFdMao9udk6/hg5J10CoU3X88qj81itAY6qWteSn00lubMZQAiJtuerwumPNLsHMbkO0ZKmDajyr1wS+Ed 
--- a/spec/fixtures/skecdsa_ca
+++ b/spec/fixtures/skecdsa_ca
@ -0,0 +1,10 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2
+RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQSq1e4+3xiV
+8J31I26lSu/RFyqx5RvMWSI0S22tIJm4PUooO4OW5T+Di3/jZgko9uwFzr/zDZTy6uWyD
+Qhk9G8AAAABHNzaDoAAADoeklfLnpJXy4AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv
+cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEqtXuPt8YlfvCd9SNupUrv0RcqseUbzFkiN
+EttrSCZuD1KKDuDluU/g4t/42YJKPbsBc6/8w2U8urlsg0IZPRvAAAAARzc2g6AQAAAECE
+3HUalOjXfOTrfIRFnJIzVmj1Oq1o5vaGZdevL12Ue8oy01QAMvDLhu7tenBtwzXb65N6aH
+n21rJShWK/Nc6EAAAAAAAAABN2Y3Nqb25lc0BLZXZpbnMtTUJQAQ==
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/skecdsa_ca.pub
+++ b/spec/fixtures/skecdsa_ca.pub
@ -0,0 +1 @@
+sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBKrV7j7fGJX7wnfUjbqVK79EXKrHlG8xZIjRLba0gmbg9Sig7g5blP4OLf+NmCSj27AXOv/MNlPLq5bINCGT0bwAAAAEc3NoOg== vcsjones@Kevins-MBP
--- a/spec/fixtures/sked25519_ca
+++ b/spec/fixtures/sked25519_ca
@ -0,0 +1,10 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2
+gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACAdGSyAfB35x92DVqxGxRKs27JpPioJZxuX5O09
+YJG23AAAAARzc2g6AAAA+DJHBAkyRwQJAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2
+9tAAAAIB0ZLIB8HfnH3YNWrEbFEqzbsmk+KglnG5fk7T1gkbbcAAAABHNzaDoBAAAAgDKR
+R3sjWdfZ4HVt6ZDoCzSuoF24bmrztloIUdysTpc/LQWjeH/fS5ob6glvnSNVF+ilFd2nct
+hvUvDSemVXYBVc54je/gsTzTCRpnQ/557G3ABOXCYvH/C3w0D8Ogkh2e7JTrpYIJjkurlG
+Ctg2SteEN1Mms/5fQXmK0nwW3rB1AAAAAAAAABN2Y3Nqb25lc0BLZXZpbnMtTUJQAQIDBA
+UG
+-----END OPENSSH PRIVATE KEY-----
--- a/spec/fixtures/sked25519_ca.pub
+++ b/spec/fixtures/sked25519_ca.pub
@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0ZLIB8HfnH3YNWrEbFEqzbsmk+KglnG5fk7T1gkbbcAAAABHNzaDo= vcsjones@Kevins-MBP
--- a/spec/public_key/skecdsa_spec.rb
+++ b/spec/public_key/skecdsa_spec.rb
@ -109,10 +109,6 @@ describe SSHData::PublicKey::SKECDSA do
        expect(round_tripped).to eq(openssl_sig)
      end

-      it "can not verify signatures" do
-        expect { subject.verify(msg, sig) }.to raise_error(SSHData::UnsupportedError)
-      end
-
      it "blows up parsing malformed keys" do
        malformed = [algo, Base64.strict_encode64([
          SSHData::Encoding.encode_string(algo),
--- a/spec/public_key/sked25519_spec.rb
+++ b/spec/public_key/sked25519_spec.rb
@ -57,10 +57,6 @@ describe SSHData::PublicKey::SKED25519 do
    expect(subject.ed25519_key.to_bytes).to eq(verify_key.to_bytes)
  end

-  it "can not verify signatures" do
-    expect { subject.verify(msg, sig) }.to raise_error(SSHData::UnsupportedError)
-  end
-
  it "can be rencoded" do
    expect(openssh_key.rfc4253).to eq(fixture("sked25519_leaf_for_rsa_ca.pub", binary: true))
  end
--- a/spec/signature_spec.rb
+++ b/spec/signature_spec.rb
@ -0,0 +1,191 @@
+require_relative "./spec_helper"
+
+describe SSHData::Signature do
+  describe "end to end" do
+    it "can verify an Ed25519-SK git signature" do
+      message= "tree ed9f16d32a89e48289d9d4becc4ff47cbd11f58c\nparent 7c6364502eceecc87b276d8b49d8eb0ae96fd9e3\nauthor Kevin Jones <octocat@github.com> 1638815753 -0500\ncommitter Kevin Jones <octocat@github.com> 1638815828 -0500\n\ntest\n"
+      signature = <<~SIG
+      -----BEGIN SSH SIGNATURE-----
+      U1NIU0lHAAAAAQAAAEoAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgnXUo8l
+      URoToCMzr+Rxeia/9yy+Rn+VwTTOqXdIgf7TUAAAAEc3NoOgAAAANnaXQAAAAAAAAABnNo
+      YTUxMgAAAGcAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAABAud+P+aC7yCEcgy
+      smyAyN5iokI0T+dKuhl7Ml7XB/wPBlefSamMXoHE7k3BbAXBNXJQH0TtHo/aX0gZxLy44D
+      DgUAAAAG
+      -----END SSH SIGNATURE-----
+      SIG
+
+      subject = described_class.parse_pem(signature)
+      expect(subject.verify(message)).to be(true)
+    end
+
+    it "can verify an RSA git signature" do
+      message = "tree 4b825dc642cb6eb9a060e54bf8d69288fbee4904\nparent 339ca5fd2a41e29236ea793772308bb054b9d81b\nauthor Kevin Jones <vcsjones@github.com> 1637774236 -0500\ncommitter Kevin Jones <vcsjones@github.com> 1637774236 -0500\n\nWHAT\n"
+      signature = <<~SIG
+        -----BEGIN SSH SIGNATURE-----
+        U1NIU0lHAAAAAQAAAZcAAAAHc3NoLXJzYQAAAAMBAAEAAAGBANEwkDjsYE02vY+bTFXAL9
+        xaGDFRwpAYutfhl7eL1Qn6dziGnokqMz1FnwPbRkPUOtdwXbojK0W45DS8rODLhvwyEJjj
+        sY2L9pKX/6hKDgb1RjtNAv57OHnfW3qyZWM/Nyd5js9K+43JN1ECoWCTVqtAaJcyfNXY8Y
+        FeR6x5ARkBZf+tgPA2+xIdmDf0jxyZ+hr6LRnE6/N9WsrCURnwx3u8XE8kusudBXDD4XKp
+        F/AqptHwi6OML+9kRQmyXXYs1dvPaJi4TGAGlPPD7mQaWT9fsKXJZa3jl6ckzq6D7SDDPh
+        CF2e/ZpzIJuusMQrx2snhKgKYh+G4WS/FpLcan+HG+/bv91lzNBXufJSLs5oo0B13L6ZaK
+        CJMkzG4zo/evDiomkXv9Fg8f2bIw2Ayh56Cd4Dcc2MYfziG3yLiVQrDu2eCTuILYzYdcFw
+        hzxkS8V6Ep+9U4ct0Zt+hTpyloSnQ7AEX/FKHAT7xdQxVoYaY7cVRyOWMROQ6ArxiNbPnk
+        JQAAAANnaXQAAAAAAAAABnNoYTUxMgAAAZQAAAAMcnNhLXNoYTItNTEyAAABgKE+f+H3D1
+        +kgPGi1TulPivysng0PIUthoVHSpJ5OKd2VrbdiH5B/XK1DmhpxCFVy6WAKD/x7a6Qpjd2
+        VSVsKdtJeBLfniTWB/LJQD/5miEVBG10F9V5EaEl4uRiQrTTGEAznBg3k0yIUVBdWWjoJh
+        5dLw+NQNWf9yw+/hNbtcCjkMeeZLvLwZNhsFxhRiIi5cy5m6O/eSSekaXe4sj0HxmuSIwh
+        8bFRlU+JQwmJ5P1tsnyhwaSSs5qnJ0MXiDeLD5MOt9PGDJhnNarMqYkA61slhhq1XkQu1E
+        FXdurNLkKaTpViSlFXqjFGXgoyB8yWB9DuqoZm69xGtCh1TmKkyE3M2R6hqXTqc90Szkxr
+        POr3R0OsJrYu1VOc//AKz7AHp1DGHOTNZkpfYVzm76wrkPS9LMVieZkelcr75/az+w6kev
+        qi1HNSYwD+pWej8+oCw6jri/ulGHDYyARR4ZSIR2AgBP5QZ0B0aLNr5F9ufbJvkGEpUvQH
+        rfqicASU/vCBEQ==
+        -----END SSH SIGNATURE-----
+      SIG
+
+      subject = described_class.parse_pem(signature)
+      expect(subject.verify(message)).to be(true)
+    end
+  end
+
+  describe "#verify" do
+
+    Dir["spec/fixtures/signatures/message.*no-options-individual.sig"].each do |path|
+      name = File.basename(path)
+
+      describe name do
+        let(:signature) { File.read(path) }
+        let(:data) { File.read("spec/fixtures/signatures/message") }
+
+        it "verifies with data" do
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(data)).to be(true)
+        end
+
+        it "does not verify with tampered data" do
+          bad_data = data + "bad"
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(bad_data)).to be(false)
+        end
+
+        it "parses correctly" do
+          subject = described_class.parse_pem(signature)
+          expect(subject.sigversion).to eq(1)
+          expect(subject.namespace).to eq("file")
+          expect(subject.reserved).to be_empty
+          expect(subject.hash_algorithm).to eq("sha512")
+          expect(subject.public_key).to be_a_kind_of(::SSHData::PublicKey::Base)
+        end
+      end
+    end
+  end
+
+  describe "#verify security keys" do
+    Dir["spec/fixtures/signatures/message.*-sk-*no-options-individual.sig"].each do |path|
+      name = File.basename(path)
+
+      describe name do
+        let(:signature) { File.read(path) }
+        let(:data) { File.read("spec/fixtures/signatures/message") }
+
+        it "does not verify if user verification is required" do
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(data, user_verification_required: true)).to be(false)
+        end
+      end
+    end
+  end
+
+  describe "#verify no-touch" do
+    Dir["spec/fixtures/signatures/message.*no-touch-required-individual.sig"].each do |path|
+      name = File.basename(path)
+
+      describe name do
+        let(:signature) { File.read(path) }
+        let(:data) { File.read("spec/fixtures/signatures/message") }
+
+        it "verifies with data" do
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(data, user_presence_required: false)).to be(true)
+        end
+
+        it "does not verify with tampered data" do
+          bad_data = data + "bad"
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(bad_data, user_presence_required: false)).to be(false)
+        end
+
+        it "does not verify with user presence" do
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(data, user_presence_required: true)).to be(false)
+        end
+
+        it "does not verify with user presence by default" do
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(data)).to be(false)
+        end
+
+        it "errors on unknown verify options" do
+          subject = described_class.parse_pem(signature)
+          expect { subject.verify(data, potato: :no) }.to raise_error(SSHData::UnsupportedError)
+        end
+      end
+    end
+  end
+
+  describe "#verify verify-required" do
+
+    Dir["spec/fixtures/signatures/message.*verify-required-individual.sig"].each do |path|
+      name = File.basename(path)
+
+      describe name do
+        let(:signature) { File.read(path) }
+        let(:data) { File.read("spec/fixtures/signatures/message") }
+
+        it "verifies with data" do
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(data, user_verification_required: true)).to be(true)
+        end
+
+        it "does not verify with tampered data" do
+          bad_data = data + "bad"
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(bad_data, user_verification_required: true)).to be(false)
+        end
+      end
+    end
+  end
+
+  describe "#verify certificates" do
+
+    Dir["spec/fixtures/signatures/message.*no-options-certificate.sig"].each do |path|
+      name = File.basename(path)
+
+      describe name do
+        let(:signature) { File.read(path) }
+        let(:data) { File.read("spec/fixtures/signatures/message") }
+
+        it "parses correctly" do
+          subject = described_class.parse_pem(signature)
+          expect(subject.sigversion).to eq(1)
+          expect(subject.namespace).to eq("file")
+          expect(subject.reserved).to be_empty
+          expect(subject.hash_algorithm).to eq("sha512")
+          expect(subject.public_key).to be_a_kind_of(::SSHData::Certificate)
+        end
+
+        it "verifies with data" do
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(data)).to be(true)
+        end
+
+        it "does not verify with tampered data" do
+          bad_data = data + "bad"
+          subject = described_class.parse_pem(signature)
+          expect(subject.verify(bad_data)).to be(false)
+        end
+
+      end
+    end
+  end
+
+end
				`@ -0,0 +1 @@`
				ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgzkt8R6EX7iCu4+5Fr1Dt4UqYAREilnmKsBX90/2EEUUAAAADAQABAAABgQDHMiPRJnPmtdB0LKzlngDybsRDcAihebQIYnzKOAhMHQzwe28zhpUF4N7+76fNTUPbgJ8upEW8xRBGFYARElyVr7PBIyYGDWrP3ZI1r5Bg622K4GFbCDOtqY7UXtNSgm77WYhL9TsITZY0mn5Npfkgcu2s+aBDXIGQZKxblyEeqxhfRXvKn//CEMZQJ0VZO8H+rtVaazh2quXZD4jIm1iCmAE6DYOEQuc7/W6YvH90tjLIst/CRYqzMEzXa2S0PR0puei5nSmvGAq3RdS0g5X1E5deEAl71Pddaq5OO6VPYTkWIe0ndkZZ2ddYU/OaY2XN+QweP5ioQRqg+I4QOBedh6zNocfpp1W7OrCoS3Vab1nPmyqllVo3mlk4rjDpsAWDvqU1AboUzfDKJWA6kh11lEm7QQs0L5l5DgtFFz7kc7Bum2ogx2yMnhhjnkWebFPv/t08wN/0jPtpWbd/srbA1HSccTmsIYJEi3CD84ONML4cfaOtXZTDzFQN5a+K5b8AAAAAAAAAewAAAAEAAAAIbXktaWRlbnQAAAAMAAAAAnAxAAAAAnAyAAAAAAAAAAD//////////wAAABIAAAADZm9vAAAABwAAAANiYXIAAAAwAAAAA2JhegAAAAgAAAAEcXdlcgAAABVwZXJtaXQtWDExLWZvcndhcmRpbmcAAAAAAAAAAAAAAH8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEqtXuPt8YlfvCd9SNupUrv0RcqseUbzFkiNEttrSCZuD1KKDuDluU/g4t/42YJKPbsBc6/8w2U8urlsg0IZPRvAAAAARzc2g6AAAAdwAAACJzay1lY2RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAASAAAACAoTZ3DnZY5pDal5IIk3wF0T62keDPE120XADZOD6bR9AAAACBdNq4i61BbTncPBPlRrW/MwxiCLYVCrClYwUEwoPTH2gEAAAAO vcsjones@Kevins-MBP
				`@ -0,0 +1 @@`
				ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHMiPRJnPmtdB0LKzlngDybsRDcAihebQIYnzKOAhMHQzwe28zhpUF4N7+76fNTUPbgJ8upEW8xRBGFYARElyVr7PBIyYGDWrP3ZI1r5Bg622K4GFbCDOtqY7UXtNSgm77WYhL9TsITZY0mn5Npfkgcu2s+aBDXIGQZKxblyEeqxhfRXvKn//CEMZQJ0VZO8H+rtVaazh2quXZD4jIm1iCmAE6DYOEQuc7/W6YvH90tjLIst/CRYqzMEzXa2S0PR0puei5nSmvGAq3RdS0g5X1E5deEAl71Pddaq5OO6VPYTkWIe0ndkZZ2ddYU/OaY2XN+QweP5ioQRqg+I4QOBedh6zNocfpp1W7OrCoS3Vab1nPmyqllVo3mlk4rjDpsAWDvqU1AboUzfDKJWA6kh11lEm7QQs0L5l5DgtFFz7kc7Bum2ogx2yMnhhjnkWebFPv/t08wN/0jPtpWbd/srbA1HSccTmsIYJEi3CD84ONML4cfaOtXZTDzFQN5a+K5b8= vcsjones@Kevins-MBP
				`@ -0,0 +1 @@`
				ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4PGxkCNXdCRRWGtgXvwlG3t7+QMBAuVya4s038Zy8PdHV3SvR5XVGcOta23yRPdZwPEfFV7LK8BrdLVUBSFA6ddsCZzqSUS+F/yR32v8oluyop1zIQ6FJOVPr2CD5+impFr075Jj4/abPRmbol1Wt2aeIVXJirUYoeeV+pQYQuF1rhREtbneZVrZqEqMWDWhBl/57TOgNW47qBxmzVtIhiizkGQARHQVIn6vVRkv6tJjL6YUFdpDqYMiJaXT/eyppVGs2WoqEJ2J98OWnncYFTi7fZvyH4GptLrX00LztdtdL2KDC7r/5aobaSWse9hd3ag+OpOcCXgOesJ/HIAEGRSqHTu2slk+oGV2thqiDPBQvUtgJ1gjnJAaoqK8vi4g3L0PJl60sW+Q83mZqTHAAMTmf11J/fu0yhDEzuStShTGs8ntjwELNDYtGQ/nUwb2HglMxCB7UVl8GOGVt/khqChdY58o3CCAEE4Mm9lF5biunNMsriS0FV5fr6x14Qtc= vcsjones@Kevins-MBP
				`@ -0,0 +1 @@`
				`ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBElFRWK8YOCzsBUXJKTwGUj2IjV43RYhEZyL1LJX1TYtjPZTXepSpohIqq/GInDPVWIUFkc+qmcrGc3GTktRuV4=`
				`@ -0,0 +1 @@`
				`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7zsSCg5ql5RyyMLB2glDdmLmrxyQXHSbmPPvmK0TdzqgdsgK7SqjqJ0578O1JPWBpmQVPpd41cGIsjZ9EUGF39NSsdXA6R2IWvBoEy/ld+PqdHzAjVmtHf2J8FnZInWqmzWlTCQ0aihexkgg2nbbgZigqyf7rfz0n0jxAArOPFbDcwyHK+oVfenoMnQQK6yAF83QJBJXjfJ/m5FBcx/QhBDF0D19FLADcOPJW1FWO38cn8tv7FENNwaoh4plhhQZKNycU1YE6zxJh9qoUfZuiTEB5wL0RYjHixezOSDDQEVKIvyPKHZ5wNMbnhGg480NKsrsq3+oM5Mwcmb+qnLFx`
				`@ -0,0 +1 @@`
				`ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBAVilJLES7MAMDHdgBO54ANJhTc5EDVZLGb/QO8F9PyJCewdG6rLYcN00+BlDRHJiyIv04LA41mMrc//qYMiswNnJhRjKUxxR3+2wV2V2w2EwNPJsZWackVZArWOdTup1Q==`
				`@ -0,0 +1 @@`
				`ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAFvSUc/k8UL65HG9JOL1kvb2eoaob5DMLPLwa8XqztLmEVv08RfZK9sBltDTN6ufcxtYXoosnLYLQZPxvL8Hp0FZACLsE+errtf4rZSABllK01CLsXX1YFMLVErO6IxdVdPBQlGvxmQlqMPfqOsEPXQmogY/kTpufyv1a7nk3yUoj7rCg==`
				`@ -0,0 +1 @@`
				`sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBL/WxNaEGP9UbW8QOCJGVWrULn38X4N2O72cjreQZn1zqR/QAMdUJT5fZcy96itn954E6YQqSkXNBX2cv3YAIfEAAAAEc3NoOg==`
				`@ -0,0 +1 @@`
				sk-ssh-ed25519-cert-v01@openssh.com AAAAI3NrLXNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIOUUeX8eLl0bqtOTw8lbpTLJIyMqEncpYNDPeOav/OIMAAAAIBn5Bq02RhaiaWiWYp275MaSojfbqWadp5+w/pfBpcGqAAAABHNzaDoAAAAAAAAAAAAAAAEAAAATb2N0b2NhdEBleGFtcGxlLmNvbQAAAAAAAAAAAAAAAP//////////AAAAAAAAAAAAAAAAAAAAfwAAACJzay1lY2RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQS/1sTWhBj/VG1vEDgiRlVq1C59/F+Ddju9nI63kGZ9c6kf0ADHVCU+X2XMveorZ/eeBOmEKkpFzQV9nL92ACHxAAAABHNzaDoAAAB4AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAABJAAAAIED9hCQsE3Za7BMdXOdMADHnmW4iAPntaLlEmEBtyiiUAAAAIQCHIjSE8XmleYbMnni8ObwdpGJPx2dQ+lCxjuJE9l1XlQEAAAAr ./ecdsa-sk-256-ed25519-sk-256-leaf-no-options-certificate.key.pub
				`@ -0,0 +1 @@`
				`sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBn5Bq02RhaiaWiWYp275MaSojfbqWadp5+w/pfBpcGqAAAABHNzaDo=`