Show HN: Sod – Touch ID-Backed SSH Keys Using the Secure Enclave

- **Secure Enclave**: A dedicated hardware security chip in Apple devices (Mac, iPhone, iPad) that stores cryptographic keys in isolation from the main CPU and OS. Keys inside it can never be extracted — they can only be used for signing operations, and often require biometric authentication (Touch ID / Face ID) to authorize each use. - **SSH keys**: The standard way to authenticate to remote servers without typing a password. Normally the private key sits in a file on disk (~/.ssh/id_ed25519) — if your machine is stolen, that file can be stolen too. - **What sod does**: Generates an SSH key inside the Secure Enclave that physically cannot leave the chip. It then runs a lightweight ssh-agent that uses the Enclave for signing, so each SSH connection requires your fingerprint. The remote server needs no changes — it sees a normal ECDSA public key. - **Who it's for**: Mac users (Apple Silicon or T2-equipped Intel) who want phishing-resistant, hardware-backed SSH keys without buying a separate YubiKey. The trade-off: key type is fixed to NIST P-256 (not Ed25519), and each auth round-trips to the Secure Enclave, which adds slight latency compared to a file-based key.