B
BetterSign
· SSH access that survives rotation
1 / 3
‹
›
You rotate your SSH key — now you must edit
authorized_keys
on every host
🖥️ prod-1
OLD KEY
~/.ssh/authorized_keys
ssh-ed25519 …old
🖥️ prod-2
✗ MISSED
~/.ssh/authorized_keys
ssh-ed25519 …old
🖥️ prod-3
✗ LOCKED OUT
~/.ssh/authorized_keys
ssh-ed25519 …stale
Miss one and you are locked out — or a stale key lingers forever. So nobody rotates SSH keys.
Hosts trust your identity, not a static key:
vlad:z6Mk…dev
Entry N
/ssh/key: k0
signed ✓
→
Entry N+1 · rotate
/ssh/key:
k1 (new)
signed by k0 ✓
Rotating your SSH key is
one signed plog entry
— your identity never changes.
A watcher on each host verifies the change and rewrites
authorized_keys
automatically
🖥️ prod-1
OLD
✓ ssh ok
authorized_keys
…old
ssh-ed25519 …new
🖥️ prod-2
OLD
✓ ssh ok
authorized_keys
…old
ssh-ed25519 …new
🖥️ prod-3
OLD
✓ ssh ok
authorized_keys
…old
ssh-ed25519 …new
Access never broke.
Every host updated itself · old key removed everywhere · 0 files hand-edited