Feature Request: Support Host-Key-Certificates

[maximilian-maisel-bl]

I'd like to use this SSH client library to connect to a dynamic group of devices
at work which are identified through SSH host certificates on first connection
instead of traditional static host-keys. The certificate and certificate
public-key is known to the application in the SSH format.

In this mode, the server uses host key algorithms suffixed with
-cert-v01@openssh.com like:

• rsa-sha2-256-cert-v01@openssh.com
• ecdsa-sha2-nistp256-cert-v01@openssh.com

These host key algorithms are currently not supported by russh which causes either

• A fallback to static hostkeys which will fail during verification
  since the application does not know all possible host keys beforehand.
• Failure of the connection attempt if no non-certificate based hostkey algorithm is
  offered by the server.

A possible implementation of this feature could pass the received host-certificate to
the check_server_key handler where it has to be verified by the application that
the signature vylid and from a known CA, e.g. through the method
ssh_key::certificate::Certificate.validate.