path "sshca/sign/host" {
    capabilities = ["create", "update"]
}