Add local SSH key signing in browsers and desktop apps

[theogravity]

What changes

Adds Use a key from my machine to SSH authentication. Browsers sign locally in a disposable worker; desktop apps use a native picker and a separate encrypted-key unlock window. Private keys and passphrases are never uploaded. Both paths approve a destination and verify host-bound authentication before issuing one signature, with a 90-second lifetime.

The form explains browser trust and memory-erasure limits only when selected. It preserves the chosen file and passphrase for retry, shows actionable inline failures, and removes failed pre-authentication subshells. Once a signature has been issued, uncertain outcomes preserve the subshell to avoid terminating a working connection. Destination confirmation uses labeled connection details, recent destinations show their resolved address, and SSH headers have a tooltip icon.

The server/node bridge is session-scoped, permission-checked, bounded, and sequence-checked. This includes protocol 21 compatibility, native IPC restrictions, documentation, and changesets. Development testing can point the hot-reload frontend at an isolated backend with DEV_API_ORIGIN.

Security limits

Browser signing requires trusting the website and its operator: compromised page code could steal a selected key or passphrase. Worker termination and buffer clearing cannot guarantee physical memory erasure. The native path keeps private material outside the remote page and supports Ed25519, ECDSA and 2,048–8,192-bit RSA private and host keys. Native RSA signing and host-proof verification use AWS-LC through OpenSSL Rust bindings; ssh-key’s affected RustCrypto RSA backend stays disabled. RSA accepts SHA-256 and SHA-512 only, with exact algorithm/flag matching and library validation of private components. Browser RSA uses Web Crypto. Failed browser attempts retain file access and the passphrase for retry; the 90-second signing limit does not clear those form inputs. Both paths require host-bound SSH authentication; jump hosts and host-key aliases are unsupported.

Validation

• Full TypeScript test suite: all 54 tasks passed; all 56 type-check/build prerequisite tasks passed.

• Lint, package consistency, license, design-token, prose, and whitespace checks passed.

• Full Rust formatting, clippy, and tests passed in all three crates; native signer authenticated against real OpenSSH.

• Browser signer tests cover OpenSSH parsing, encrypted keys, independent signature verification, host/session/user binding, replay, concurrency, expiry, and cleanup. Real Chromium worker checks passed for Ed25519, RSA, and all supported ECDSA curves, encrypted and unencrypted.

• Real browser/OpenSSH E2E passed: failed unlock retains selection/passphrase, rejected authentication removes its subshell, retry succeeds, and outgoing requests contain no private key or passphrase. Native graphical picker/unlock interaction has not been manually exercised headlessly.

• Native RSA validation: all three Rust crates passed formatting, Clippy and tests. Seven real OpenSSH scenarios passed, including encrypted RSA keys, RSA host keys, and both SHA-256/SHA-512. Tests cover invalid components, size bounds, mismatched flags, wrong hosts/messages, SHA-1 rejection and single-use consumption. A backend identity test confirms AWS-LC is linked.

• Dependency trees for both desktop apps across all targets contain no active rsa crate. Linux and macOS CI build prerequisites include CMake and Clang/libclang.

• Connection form: 54 focused tests passed, including retry retention. Linux native tests passed locally; native graphical picker/unlock behavior and macOS builds still require their platform checks.

[theogravity]

RSA real-wire proof, run explicitly for the AWS-LC change (closes the round where review asked for recorded evidence).

cargo test --locked --test ssh_signer_openssh -- --ignored
test real_openssh_accepts_one_native_hostbound_signature ... ok
test real_openssh_accepts_encrypted_rsa_and_rsa_host_keys ... ok
test result: ok. 2 passed; 0 failed; 0 ignored

Host: Linux x86_64, OpenSSH_10.2p1 (Ubuntu-2ubuntu3.6). The RSA pair exercises the non-canonical-s encoding concern directly: impl Encode for Signature in ssh-key 0.6.7 writes the PKCS1 blob as a raw string, and the real sshd accepted the login anyway.

Both tests spin up their own isolated sshd on 127.0.0.1 with a temp root, so no host state is involved. They stay #[ignore]d; the file header says to run them explicitly for SSH signer changes, and that is what this note records for HEAD ea40e33.