I think the most important thing in this US election is it being perceived as legitimate and so I'd encourage anyone who reads this to vote, but also my spouse is trans and so the result has a real outcome on my life and my contribution to the US and if that's a thing you care about please vote with that as a consideration

@chrysn embed the ekcert, ak and credential activation and key attestation blobs in the cert, have an Authorized principals command verify them and ensure they validate the host pubkey

I have, horrifyingly, also just figured out a way to tie TPM-based key attestation into SSH certificates such that you can verify that an SSH host key is hardware backed

I sent a patch to make openssh do a fun thing! (Do not use this on its own, it really needs more infrastructure that I've written but haven't tested but I want to make sure this is something people actually want first) https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-October/041618.html