backport of commit c56b198 (#17720)

Co-authored-by: aphorise <[email protected]>

website/content/api-docs/secret/ssh.mdx

@@ -807,8 +807,13 @@ $ curl \
 
 ## Sign SSH Key
 
-This endpoint signs an SSH public key based on the supplied parameters, subject
-to the restrictions contained in the role named in the endpoint.
+This endpoint signs an SSH public key based on the supplied parameters and 
+subject to the restrictions of the role named in the path. Both `create` and 
+`update` policy capabilities are needed to sign and update SSH keys. If only 
+`create` capability is granted, and a SSH key does not exist, it will be created 
+using the default parameters already configured. If only `update` capability is 
+available and a SSH key does not exist, an error will be returned and SSH keys 
+must exist already before may be updated.
 
 | Method | Path              |
 | :----- | :---------------- |