# ADR 0009: SSH Trust And SSH Proxy

## Status

Accepted.

## Decision

SSH keys are admin signing identities and ecosystem integration points. SSH is
not a geth transport. Future SSH proxy support will carry SSH protocol bytes over
authorized Iroh streams, and OpenSSH will still perform normal login auth.

Geth also manages OpenSSH certificate request, renewal, approval, import, and
revocation-list metadata. Signing is explicit: an approved request yields a
concrete `ssh-keygen -s ...` command that can be run on the machine holding the
CA key or attached YubiKey.

## Consequences

Knowing an Iroh EndpointID is insufficient to reach sshd. Geth authorization must
allow `ssh_proxy.connect` before any SSH/admin endpoint is opened.

Certificate and key revocations are durable geth metadata and should be
distributed over Iroh between authorized nodes. Discovery does not grant trust in
certificate requests, issued certificates, or revocation lists.