Correcting myself: in the ssh-keygen manpage it says that the cert format is not X.509:

  Note that OpenSSH certificates are a different, and
       much simpler, format to the X.509 certificates used in ssl(8).