An easier, more secure approach, would be authviassh://authviassh@auth.server/origin.domain/nonce parsed restrictively authviassh:\/\/authviassh@(${d

An easier, more secure approach, would be authviassh://authviassh@auth.server/origin.domain/nonce parsed restrictively authviassh:\/\/authviassh@(${domain_regex})/(${domain_regex})/([0-9a-zA-Z]+) prompting the user: "Would you like to log into origin.domain (via auth.server) using ~/.ssh/your_key?" and then finally running ssh "authviassh@auth.server" -- authviassh "origin.domain" "nonce" with the appropriate additional flags to turn off forwarding et al Only problem is, only 1 language has decent bindings for ssh interactives server-side, so one is somewhat forced to learn Go to implement this easily