[asojfdowgh]

An easier, more secure approach, would be

    authviassh://[e-mail]/origin.domain/nonce

parsed restrictively

    authviassh:\/\/authviassh@(${domain_regex})/(${domain_regex})/([0-9a-zA-Z]+)

prompting the user:

    "Would you like to log into origin.domain (via auth.server) using ~/.ssh/your_key?"

and then finally running

    ssh "[e-mail]" -- authviassh "origin.domain" "nonce"

with the appropriate additional flags to turn off forwarding et al

Only problem is, only 1 language has decent bindings for ssh interactives server-side, so one is somewhat forced to learn Go to implement this easily

[pxx]

This seems similar in concept to https://github.com/michft/ssh-mars or https://github.com/wes1138/webauth-via-ssh but you could imagine that the person running the SSH server doesn't necessarily need to be the person running the website.