support sshkey of type `cert-authority`

Use Case

I'd like to have this module add a cert-authority to the global known hosts file.

Describe the Solution You Would Like

This module could allow a sshkey of type cert-authority to populate a known_hosts entry; maybe something like this:

sshkey { '*.example.com':
  ensure => present,
  type   => 'ssh-rsa',
  marker => 'cert-authority',   # or 'revoked'
  key    => 'AAAA…',
}

that would add an entry to the known hosts file

@cert-authority *.example.com ssh-rsa <key>

Describe Alternatives You've Considered

I cannot workaround this; if I add a cert-authority line manually, it leads to an error

Error: /Stage[main]/Ssh/Resources[sshkey]: Failed to generate additional resources using 'generate': Parameter type failed on Sshkey[@]: Invalid value "cert-authority@*". Valid values are ssh-dss, ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com.

Additional Context

Start by locating the sshkey resource's type validation and the code that generates entries for the global known hosts file. Trace how the marker and key type are rendered, then verify that a cert-authority declaration produces an @cert-authority entry for the requested host pattern without rejecting the value.