SSH key vault and agent · Windows and Linux · no cloud
SSH keys that know where they're going.
One encrypted vault, unlocked by your YubiKey. An agent that asks before anything reaches root, and tells you afterwards about logins it didn't make.
The vault
Keys that never leave.
Everything is encrypted at rest and signed inside the agent, so ssh never sees a private key. Unlock with a YubiKey touch and PIN, or a passphrase. A 24-word phrase recreates every key you generated, on a new machine, offline.
About the vault →The approval
It asks when it matters.
keyward verifies which server a signature is for and what that account can do there. Root, sudo and anything arriving through agent forwarding always ask. Approving is a real touch or passphrase, not a click malware could fake.
How approvals work →The audit
It checks afterwards.
A tiny server half, reached only through ssh, reports every account, what it can do, and when each key was last used. keyward compares that with what it signed. A login it didn't make means a key exists outside the vault, and you hear about it.
About servers →3 accounts · daf 2 h agoneeds you
6 accounts · svcadmin 1 d agook
2 accounts · svcadmin 5 d agook
2 accounts · ubuntu 3 w agoaudit stale