I was able to find documentation for it in an old version of the `PROTOCOL.agent` file in the OpenSSH repo: https://github.com/openssh/openssh-portable/blob/531c135409b8d8810795b1f3692a4ebfd5c9cae0/PROTOCOL.agent
Specifically the difference between what is specified there and trying to pass certificates encoded as des https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys