I have a large number of notes that I need to write up on the subject of SSH certificates. Until I do this, you will likely find the following links useful instead:

• https://wiki.mozilla.org/Security/Guidelines/OpenSSH
• https://blog.habets.se/2011/07/OpenSSH-certificates
• https://ef.gy/hardening-ssh
• http://www.lorier.net/docs/ssh-ca
• https://code.facebook.com/posts/365787980419535/scalable-and-secure-access-with-ssh/ - A more recent Facebook write-up of what Google has done internally for years (I believe it was in fact that Google contributed the OpenSSH certificate code back to the OpenSSH project)

If you have lost your public key part, you can regenetate it from your private key:

ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/id_rsa.pub