Blink's ssh does not validate remote hosts using their public host keys certificates

### Checklist

- [x] Using latest version on the [App Store](http://itunes.apple.com/app/id1156707581)
- [x] Read the [docs](http://blink.sh/docs/)
- [x] Searched for [existing GitHub issues](https://github.com/blinksh/blink/issues)

### Configuration

Current blink version from App Store. iOS 26.3.1 on iPhone 17.

I have ~/.ssh/known_hosts containing @cert-authority public keys, e.g.:
@cert-authority *.domain.name ssh-ed25519 AAAAC3N...
...

### Describe the bug

ssh is ignoring @cert-authority public host keys. Instead of validating remote hosts using their signed host keys, ssh is doing the standard TOFU, prompting for verification and then appending host keys to known_hosts.

Can blink ssh be improved to support host key validation via @cert-authority?

Start by tracing Blink's ssh handling of ~/.ssh/known_hosts and its @cert-authority entries. Reproduce the issue with a signed host key, then verify that matching hosts are validated through the certificate authority instead of triggering TOFU verification or appending ordinary host keys.

Written by the indexing model from the issue text.