I am currently looking into the possibility of using Yubikey (NEO)'s to store the private SSH keys of my users. By searching the internet I've found several places that explain how you can generate a GPG master key and subkey, import it on your Yubikey, export and convert the public key and setup gpg-agent to connect via ssh.
What I can't seem to find anything about is a way to also sign the key and load that into gpg-agent using OpenSSH's method for signing user keys. For my servers I have generated a key using ssh-keygen and set that key up as a CA via TrustedUserCAKeys in sshd_config. After converting the GPG public key to an OpenSSH public key I can sign it using ssh-keygen, but I'm unable to get gpg-agent to use the private key in combination with the signed public key. I know I can put the signed key in the authorized_keys file on the server, but the main advantage in my use case of using TrustedUserCAKeys is that it alleviates the burden of having to maintain an authorized_keys file for all users on all servers and instead only having to maintain a revoked_keys list. So I'd like the signed key to be placed on the client side rather than the server side. Putting it on the server side would defeat the purpose of signing the key in the first place except for the added expiration date.
It is not a requirement to have the signed public key loaded onto the Yubikey and/or into gpg-agent, if there is a way to have PuTTY, MobaXterm or some other Windows SSH connection tool or any tool at all to make the SSH connection use the signed public key as opposed to the unsigned public key, whether it via the Yubikey, gpg-agent or loading the file separately, that would be a great solution as well.
Is this at all possible or is there no solution (on Windows) that supports including a signed public key with a private key?
Also something I just thought of is that if I can somehow sign the subkey with another PGP key and use that PGP key as the ssh CA that'd be fine too, as long as it's possible to convert it to an OpenSSH private key to also sign regular SSH keys.