> After examining a variety of different possible solutions, we came to the conclusion that the least-worst option was to patch OpenSSH to lookup keys in a MySQ

> After examining a variety of different possible solutions, we came to the conclusion that the least-worst option was to patch OpenSSH to lookup keys in a MySQL database, indexed on the key fingerprint. Why MySQL rather than sqlite? They were trying to speed up access to ~/.ssh/authorized_keys. That's the kind of situation mysql is designed to shine in. I would have expected that patching OpenSSH to check for ~/.ssh/authorized_keys.db would be less work than patching it to use MySQL.