> I'm talking about using an already provisioned device with this new-ish OpenSSH feature Talking about these things is a bit confusing because the keys do so

> I'm talking about using an already provisioned device with this new-ish OpenSSH feature Talking about these things is a bit confusing because the keys do so much, but the simple answer is that you'll need to generate a new key, yes. You need to get the key from the device, at no point will you have the private key outside the device, which means you won't be able to use one you generated previously. > In your blog post you say it produces two files, the private and public keys. If it generated on device it wouldn't (be able to) have the private key? I may be misunderstanding your question, but the "private" key it generates is more of a reference to the one existing on the device, not a standalone private key that you get when you generate one with ssh-keygen. The way it actually works is that these devices come with some randomness baked in and they use that to derive all the private keys you need with various cryptographic techniques. You can never extract any of those private keys (which is where the security lies) .