> Bootstrapping a new system is checking in their ssh key and running a shell script. If it interests you, both major git hosts (and possibly all of them) have

> Bootstrapping a new system is checking in their ssh key and running a shell script. If it interests you, both major git hosts (and possibly all of them) have and endpoint to map a username to their already registered ssh keys: https://github.com/mdaniel.keys https://github.com/mdaniel.keys https://gitlab.com/mdaniel.keys https://gitlab.com/mdaniel.keys It's one level of indirection away from "check in a public key" in that the user can rotate their own keys without needing git churn Also, and I recognize this is departing quite a bit from what you were describing, ssh key leases are absolutely awesome because it addresses the offboarding scenario much better than having to reconcile evicting those same keys: https://github.com/hashicorp/vault/blob/v1.12.11/website/content/docs/secrets/ssh/signed-ssh-certificates.mdx https://github.com/hashicorp/vault/blob/v1.12.11/website/con... and while digging up that link I also discovered that Vault will allegedly do single-use passwords, too <https://github.com/hashicorp/vault/blob/v1.12.11/website/content/docs/secrets/ssh/one-time-ssh-passwords.mdx https://github.com/hashicorp/vault/blob/v1.12.11/website/con...>, but since I am firmly in the "PasswordLogin no" camp, caveat emptor with that one