They tie your SSH login to a physical FIDO security key, so a stolen key file is useless without the device. OpenSSH supports this with ed25519-sk and ecdsa-sk key types, plus options that require a touch or a PIN. The cost is extra setup and a spare key you must plan for.
What an sk key is
OpenSSH's ssh-keygen accepts several key types. The manual lists ecdsa-sk and ed25519-sk as the types backed by a FIDO authenticator, in addition to plain ed25519, which is the default, and rsa. With an sk key, the private key file on disk is only a handle. The actual signing happens on the security key.
GitHub's SSH documentation makes the same point from the user side: you can further secure your SSH key with a hardware security key, which requires the physical hardware to be attached to your computer whenever the key pair is used to authenticate.
What it protects against
A normal private key file can be copied by malware, by a backup tool or by anyone with brief access to your disk. A copied sk handle does nothing without the device. That makes it a good fit for developers whose laptops hold access to production or to release signing infrastructure.
It does not stop a threat that runs while the key is plugged in and you tap it. Touch is a user presence check, not a judgment about which action you are approving, so stay alert to unexpected prompts.
Options worth knowing
The ssh-keygen manual documents key options for these authenticators:
| Option | Meaning |
|---|---|
| touch-required / no-touch-required | Add or remove the need to demonstrate user presence, such as touching the device |
| verify-required / no-verify-required | Add or remove the need to verify identity first, such as a PIN or on-device biometrics |
| -K | Download resident keys from a FIDO authenticator |
Resident keys are stored on the authenticator itself, so you can pull them onto a new machine with ssh-keygen -K. The manual notes that not every FIDO authenticator supports every option, so check your device.
Basic setup
A typical generation command looks like this:
ssh-keygen -t ed25519-sk -C "work laptop key"
You will be asked to touch the device, then to choose a file location and optionally a passphrase. Add the public key to your Git host, test a login, and keep a second registered key somewhere safe so that losing one device does not lock you out.
Trade-offs to plan for
Automation does not work with a key that needs a human touch, so keep deploy keys and CI credentials separate and scope them tightly. Some older servers and tools may not support sk key types, and corporate security keys may be managed by your IT team, so check policy before buying hardware. Document the recovery path for a lost device before you roll this out to a team.
Where Safeguard fits
Safeguard works on the dependency and code side of your software: SBOM and dependency scanning, reachability analysis and policy gates. It does not store or manage credentials, so keep using your password manager, secrets manager or cloud identity for that. You can run a free scan of a project at gold.safeguard.sh/scan.
Quick check
Is an sk key safer than a passphrase protected key?
It adds a physical factor, since signing needs the device. A passphrase protects a file at rest. They can be combined.
Can I use one in CI?
A key that needs a touch is built for people. Use a scoped deploy key or short-lived token for automation.
What if I lose the security key?
Remove its public key from every service and use the second key you registered.
Sources
Last reviewed: 19 October 2026.
