Hi HN! Today I wanna show you a thing that solved my headache (and maybe will solve yours too). The only reason I created this tool is a mess around my SSH keys and configs. I am constantly working with a bunch of devices via SSH (such as Raspberry Pi's, VPS, handmade NAS, etc.) and I never knew whether permissions were right and there was no way to tell a strong key from a weak one. So, meet Keyward

Main features:

1. Lists every key with algorithm, size, fingerprint, comment, date of last modification and whether it has a passphrase

2. Runs a security audit for all of your keys, config and permissions in ~/.ssh and grades the result with A-F score. Also here you can find fix suggestions for every problem

3. Editor for ~/.ssh/config with byte-identical round-trip so all your comments are untouched

4. Convenient key generator for those who have difficulties using the "ssh-keygen" command

5. Backup of your keys, config and encrypted metadata so u can move all of your files quickly and safely and restore them on another machine

6. Headless CLI, e.g. keyward audit --json --fail-on=warning

7. Look through your known_hosts file to see address, key type and fingerprint and delete unnecessary records

Private keys are deliberately NOT encrypted by Keyward, they stay protected by their own passphrases.

No daemon, no network calls, no config to learn before starting, just a single static Go binary. The security-sensitive core's direct dependencies are only filippo.io/age and golang.org/x/crypto, releases are cosign-signed. Threat model is in SECURITY.md

Install:

   brew install gateway-of-last-resort/tap/keyward for macOS/Linux,
   yay -S keyward-bin for Arch Linux
   binary / go install for Windows

I would love feedback, especially on audit checks: what SSH misconfig should it catch that it doesn't?