Certificate access
Enroll a server once. Never hand out a key again.
A one-line install makes the server trust your account's SSH certificate authority. Every login after that uses a fresh certificate that expires in five minutes.
# on the server, as root curl -fsSL https://your-k2shell-host/enroll/<one-time-token> | sh ✓ CA added to sshd (TrustedUserCAKeys) ✓ principal allowed for user deploy only ✓ sshd -t passed, reloaded ✓ host key pinned: SHA256:3f9c…a1
What you get
Your own CA
Each account has its own ed25519 certificate authority, sealed at rest.
Five-minute certificates
A fresh key and certificate per connection, with only the permissions it needs.
Pinned host keys
The host key is reported over HTTPS at enrollment, not trusted on first use.
One login user
The server accepts your principal only for the user you chose.
One-time links
Install links work once and expire after an hour.
No outbound access?
Paste the script instead and confirm the host key fingerprint by hand.