Add --id and --secret options to ssh-gen

Hello,

While setting up ssh for my machines, I noticed that it seems impossible to use cloudflared so that it will sign a short-lived certificate while using automated service credentials. So while services can tunnel directly to a machine, I don't see how/if they are able to use short lived certificates, which means the service needs to know the username or the private-key for a user on the machine, which is not ideal.

Is there a way to use short lived certificates with automated services? If not, is that a planned feature? Can I help implement it somehow (I can't figure out how -- if at all possible -- to get a valid jwt token with only my service token, so unlikely..)