The `sshca-cli user login` command now requests a signed certificate
from the SSHCA server. Given a valid OpenID Connect identity token and
an SSH public key, the server will return a signed certificate, valid
for a predetermined (usually short) period of time. The principals
listed in the certificate are derived from the ID token.