# sshkeys.io

> A verified SSH key directory. Publish your SSH public keys at a memorable URL — signed end-to-end by your own identity key, recorded in an append-only transparency log, and servable directly to your servers. The service is untrusted distribution: a fully compromised sshkeys service cannot forge or inject a key anywhere.

sshkeys.io hosts signed keysets at `https://sshkeys.io/<handle>.keys` (plain `authorized_keys` format) with cryptographic guarantees GitHub's `.keys` endpoint cannot give: proof-of-possession at publication, permanent logged revocation, FIDO2 hardware attestation, and third-party identity verification (GitHub, GitLab including self-hosted, DNS).

## How it works

- **Signed keysets** — every keyset is signed by the user's identity key; consumers verify against locally pinned keys, not server trust.
- **Transparency log** — every change lands in an append-only log with signed checkpoints; revocation is history, never silent deletion.
- **Proof-of-possession** — keys are challenge-signed at publication, never just uploaded.
- **FIDO2 attestation** — prove a key lives on real hardware.
- **`AuthorizedKeysCommand` helper** — cache-first, signature-verifying sshd integration with explicit fail policies.
- **Self-hostable** — free and open source; one binary, one SQLite file.

## Pages

- [Home](https://sshkeys.io/): what sshkeys is and the verification flow
- [Security](https://sshkeys.io/security): trust model — what the service can and cannot do, tamper detection, vulnerability reporting
- [Docs](https://sshkeys.io/docs): install the CLI, publish keys, integrate with sshd, self-host
- [Pricing](https://sshkeys.io/pricing): free for individuals; self-hosting free and open source
- [About](https://sshkeys.io/about): why sshkeys exists and who runs it

## Operator

sshkeys.io is operated by [DevOps Team](https://devopsteam.io), a fractional DevOps/ITOps/SecOps consultancy.