Module sign 

ssh-keygen -Y: the one place a signature is made or checked. The namespace is a parameter, so a provenance signature and an attestation can never be confused (SPEC.md, “amont-provenance-v1”).

Enums

Error

Why a signature was not accepted. Display is the reason the verifier reports.

Functions

public_key

The public half of the private key at key, checked to be ed25519. -P '' fails at once on a passphrase-protected key instead of prompting.

sign

ssh-keygen -Y sign over payload in namespace with the private key at key: the armored signature, without its final newline. The payload goes on stdin, so nothing is written next to it.

verify

ssh-keygen -Y verify over the exact signed bytes, in namespace, as principal — or, when none is given, as whoever the signature says. Ok carries the identity the signature verified as.