I personally don't feel comfortable using your service - too much of a security risk giving Databracket LLC unrestricted root access. I guess most other securit

I personally don't feel comfortable using your service - too much of a security risk giving Databracket LLC unrestricted root access. I guess most other security-minded people would not feel at ease as well. Having an agent running on the servers would be much better. First, it will not require unrestricted SSH root access to the servers. Most of the servers don't allow root to login through SSH at all. Second, an agent restricts the harm that could be done if somebody hacks their servers. This could be achieved with restrictions (specific commands, IP addresses) to the key that is added to root's authorized_key, but there is no mention of that in the FAQ or the other docs. Third, firewall management - good luck convincing somebody to modify the firewall to allow connections to the SSH service on all of their servers. A restricted agent will be a much easier sell.