About

sshkeys is built for people who live in authorized_keys files.

Somebody leaves the team, and the honest answer to "where could they still log in?" is a shrug and an Ansible re-run. A laptop gets stolen, and the key it held quietly disappears from a directory instead of being visibly revoked. A service serves you a colleague's public key, and you have no way to know whether it's really theirs.

The interesting part of the problem was never hosting keys — GitHub does that for free. It's making key distribution verifiable: signatures the server can't forge, history the server can't rewrite, and proofs anyone can check with plain OpenSSH tooling. That's what sshkeys is.

It's an independent product, self-hostable by design, with the security model documented in the open — including the parts you still have to trust us for. Read it: the security page covers the model; the full specifications live with the source code.

Contact

General: [email protected]
Security reports: [email protected] (see disclosure policy)