FTA: >The approach we take in our own infrastructure, modeled after TLS certificate infrastructure and Let’s Encrypt in particular, is to authenticate each dev

FTA: >The approach we take in our own infrastructure, modeled after TLS certificate infrastructure and Let’s Encrypt in particular, is to authenticate each device+person combination with a separate private key; that way, if a credential is stolen, we always know from where. The startup I co-founded, bastionzero.com, is motivated by this exact problem: What is the best way to do SSH key management. We hope to improve remote shell access by replacing long lived SSH keys stored on your machine with cryptographic identity attestations from multiple sources, e.g. OpenID Connect, FIDO, Network, etc... The end goal is to eliminate both single points of trust and long lived secrets.