Post

Rotating a key is the only way to un-share it. Handing an agent your credentials has no undo, only cleanup. Keep the key with the client and give the agent a capability instead: scoped to a host, narrowed to a command, switched off in a second. Revocation should be a toggle, not an incident.