Sigh. I'll get that fixed and figure out how that happened.
This was corrected to:
> ... SSH certificates issued by the Cloudflare CA include a field called valid_principals
which indicates it wasn't just the spelling of `principals`.
It depends... ssh-keygen -L displays the fields as Principals (which are set using the -n parameter) and internally a lot of the OpenSSH code talks about AuthorizedPrincipals...