path "sshca/sign/user" {
    capabilities = ["create", "update"]
}