Feature Request: Support OpenSSH host certificates #153

It'd be great if Conduit supported OpenSSH host certificates (see docs).
OpenSSH host certificates are an OpenSSH-specific extension that has been introduced in version 5.4.
Instead of the customary host-specific public keys, the client verifies that the host's key was signed by a trusted CA key (which is basically another public SSH key). This allows moving from host-individual trust-on-first-use with optional out-of-band verification of the fingerprint to fully out-of-band verification of an arbitrary, dynamic number of hosts, including certificate and key rotation.

Conduit would need two changes:

1. UI to allow users to manually add a trusted host key. An OpenSSH compatible format would look like @cert-authority *.my.domain ssh-ed25519 AAAA... My CA key
2. Request remote host's certificates and verify them against any trusted CA keys, falling back to host key based trust.

Ideally, Conduit would also implement some way to get and use key revocation lists. OpenSSH, however, only defines the format. Administrators may choose to publish them using any file transfer mechanism, from HTTPS to carrier pigeon. It does not seem feasible for Conduit implement all of them.