ssh-keygen: signing syntax - help needed with options

You have actually already achieved what you want to do: disable all permissions, which means your list of "extensions" is empty. See what happens if you do not use -O at all, i.e ssh-keygen -s /path/to/ca-ssh.pem -D opensc-pkcs11.so -n barfoo -I foo -z 12345 /path/to/pub -What extensions are enabled then?

-All the options you are using are "no-xxxx" which means you are disabling extensions and thus emptying the list of extensions. -Instead of disabling/removing them one by one, you could use -O clear only. From the man-page:

clear ---- Clear all enabled permissions. This is useful for clearing the default set of permissions so permissions may be added individually.