This was corrected to:

> ... SSH certificates issued by the Cloudflare CA include a field called valid_principals

which indicates it wasn't just the spelling of `principals`.

It depends... ssh-keygen -L displays the fields as Principals (which are set using the -n parameter) and internally a lot of the OpenSSH code talks about AuthorizedPrincipals...