When using ssh-add -d to drop keys previously learned by invoking ssh-add without arguments, only raw key is dropped even if there is also a certificate in ~/.ssh/id_rsa-cert.pub. As I see the purpose of -d switch is to undo previous ssh-add command, I think the correct behaviour is to drop the certificate as well.
Created attachment 2193 [details] Make ssh-add -d remove certificate too Right. It is possible to remove a cert by explicitly listing its *-cert.pub file, but this isn't symmetric with ssh-add's behaviour and is therefore not what users would reasonably expect. This patch makes ssh-add -d remove both the plain key and the corresponding certificate. It also makes -d respect the recently-added -k option to allow selectively removing just the key.
Applied - this will be in openssh-6.2, due early next year
mark bugs closed by openssh-6.2 release as CLOSED