Secretive Key Attestation Possible?

On an old MacBook Pro 2019, I've been trying out Secretive ( secretive.dev ) to let me use the Touch ID (aka SecureEnclave) as a hardware SSH key, like how I would use Yubikey on other computers. One of the things I would like to do is to create a certificate authority for key signing, to avoid having to manually add new keys to each host I have to SSH into. The certificate authority needs to tell…