Skip to content
NewA calmer, faster ZeroHour
StoryResearchinfo

Posts describe moving SSH keys off disk onto hardware

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Developers describe replacing on-disk SSH private keys with YubiKey, TPM, or Mac Secure Enclave handles.

Two posts describe dropping unprotected SSH private keys stored on disk. OpenSSH can enroll resident ed25519-sk keys on a YubiKey 5 or newer with no extra software; the on-disk file is only a handle, and a tap is required unless the server marks the key no-touch-required. TPM-backed keys can use ssh-tpm-agent, which Ubuntu packages. On macOS Sequoia, the native Secure Enclave creates a non-exportable P-256 key that signs after Touch ID, but the author called that workflow too awkward to adopt after also considering Secretive, a YubiKey, 1Password, and Bitwarden.

Key facts
  • On-disk SSH key files are handles, not extractable private key material.
  • Default YubiKey use still requires a physical presence tap.
  • no-touch-required must appear in authorized_keys or OpenSSH rejects the key.
  • ssh-tpm-agent is a small Go package natively packaged by Ubuntu.
  • The Sequoia enclave path uses a non-exportable P-256 key and Touch ID.
  • ssh-add -K is deprecated and does not load these CryptoTokenKit keys.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 10, 2026Post describes deleting unprotected on-disk SSH keys. · Lobsters
  2. Nov 11, 2026Author calls native Secure Enclave SSH setup too awkward. · Hacker News

What each outlet adds

beyond the shared facts
  • LobstersYubiKey enrollment, no-touch prefix, and Ubuntu-packaged ssh-tpm-agent.
  • Hacker NewsSequoia path rejected after Touch ID and ssh-add issues.
Vendors
Apple
Products
macOSSecure EnclaveSecretiveYubiKey1PasswordBitwardenOpenSSHssh-tpm-agentApple Secure Enclave

Coverage

oldest first · one row per article · UTC
  1. · 23h ago Lobsters · securityFirst report

    Blog moves SSH keys onto YubiKey, TPM and Apple Secure Enclave

    Leftover disk files are handles only; private material stays in the token, TPM or enclave.

  2. · 16h ago Hacker News · AI

    Native macOS Secure Enclave SSH keys work but feel awkward

    The author rejected that built-in workflow after also weighing Secretive, YubiKey, and password-manager agents.