Support key expiration

We're exploring a way to support short-lived SSH keys with automatic
expiration. The spec for this is currently highly experimental,
subject to change, and therefore premature to document, but this pull
request is public and we welcome input from anyone.

I've tested this via our backports Debian image and with a key matching
our spec, confirming that it gets removed from authorized_keys within 5
minutes of the expiration timestamp.