-.\" $OpenBSD: ssh-keygen.1,v 1.164 2019/09/03 08:35:27 djm Exp $
+.\" $OpenBSD: ssh-keygen.1,v 1.165 2019/09/04 05:56:54 jmc Exp $
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: September 3 2019 $
+.Dd $Mdocdate: September 4 2019 $
.Dt SSH-KEYGEN 1
.Os
.Sh NAME
section below.
A file containing revoked keys can be passed using the
.Fl r
-flag. The revocation file may be a KRL or a one-per-line list
-of public keys.
+flag.
+The revocation file may be a KRL or a one-per-line list of public keys.
Successful verification by an authorized signer is signalled by
.Nm
returning a zero exit status.
comes from an authorized source.
This "allowed signers" file uses a format patterned after the
AUTHORIZED_KEYS FILE FORMAT described in
-.Xr sshd(8) .
+.Xr sshd 8 .
Each line of the file contains the following space-separated fields:
principals, options, keytype, base64-encoded key.
Empty lines and lines starting with a