Yes, you're exactly right. ( https://github.com/userify/shim/blob/master/shim.py#L209 )

We've thought about porting Userify to work with CA's too but haven't had many requests for that for some reason, even though I'm sure many companies do have CA's set up alongside their other PKI for SSH.