I deleted all my SSH keys

	I deleted all my SSH keys(blog.infected.systems)
	275 points by speckx 6 days ago \| 151 comments
	tl;dr: The author moved all SSH keys off-disk to hardware-backed storage using three methods: YubiKey (via `ed25519-sk` resident keys), TPM (via `ssh-tpm-agent`, which stores encrypted key material on disk but requires the TPM to decrypt), and Apple Secure Enclave (via macOS Sequoia's `sc_auth` with TouchID). Each method has tradeoffs around presence confirmation, unattended usage, and clamshell-mode limitations on Mac. Key caveat: hardware-resident keys can be lost to hardware failure, so enrolling multiple keys for redundancy is recommended.
	HN Discussion: ↓Prefers traditional SSH keys with network-level restrictions and monitoring over hardware-backed approach ~Supports hardware-backed keys but prefers GPG/PIV with PIN+touch workflow over FIDO2 sk-keys ↑Enthusiastically endorses the article's approach and shares similar migration experiences ↓Concerned about hardware failure, key loss, or TPM resets wiping keys •Asks clarifying technical questions or adds supplementary info (cheaper keys, service compatibility gaps)