The hologram server is privileged and should run behind a firewall. It will only hand out keys to successfully authenticated (using an SSH challenge-response) c

The hologram server is privileged and should run behind a firewall. It will only hand out keys to successfully authenticated (using an SSH challenge-response) clients, so it could be publicly accessible, but why go to that risk? The hologram agent that runs on your laptop, and could potentially be exposed in a cafe, attaches to lo0, so there's no way somebody on your coffee shop wifi could get the creds.