Allow for up to 3 tries of signing the cert in case of incorrect password entry.
This script generates a ssh key that is signed by a CA key to be used for certificate-based-authentication to an sshd server. See the CERTIFICATES section in the ssh-keygen man-page.