The design pattern of maximal separation of thing that holds private keys from thing that needs access to secrets is great. That's my main lesson learned from t

The design pattern of maximal separation of thing that holds private keys from thing that needs access to secrets is great. That's my main lesson learned from this article. I think this space is ripe for significant evolution. Authors point re hashicorp vault being marginally better than checking keys into source control hits home. Eg often infra is one stolen ssh key away from having code committed that can select * from vault. That also comes with crappy provenance that doesn't integrate well with gitops. My hopeful view is that we can incrementally fix this bottom-up: 1. ssh should use the mobile phone biometrics as HSM and expose that via ssh-agent 2. From there simple projects should use sops to commit their ssh encrypted secrets to git. I wrote https://github.com/tarasglek/github-to-sops https://github.com/tarasglek/github-to-sops to make it easy to share secrets this way. One can even use sshd private keys to separate secrets for infra from dev ones. 3. For more complex projects one can loop aws kms type hsms. 4. For more complex orgs we then need to borrow some cleverness from crypto ecosystem as they actually made a lot of progress in various tricks to derive trust/ownership...but instead of stupid blockchain one should keep using git. 5. This then can be extended down to database level mods where one could extend row-level ACLs with signature-based provenance checks in 4 Note I am in no way a security person. Just have a desire for someone to make this problem go away for us mere mortals.