[Foxboron]

>additionally, as I understand it, this basically boils down to use-after-free due to unsafe code, which could occur in either agent implementation, even without loading an extra .so, although the presence of .so loading in general certainly does increase the attack surface.

You are not going to see similar exploits available in a program written in Go, it would result in a crash. Not an actual code execution issue.

So you are removing attack surface by not loading shared libraries, and quite a bit of attack surface considering it's not written in C.

> this can also be partially mitigated by requiring user interaction for every signing operation, but it's also not necessarily something that works for all use cases, such as when connecting to a few hundred destination hosts.

Allowing better UX would also allow people to utilize better and more secure defaults. The PKCS11 stuff is general unfriendly and using it correctly as a result gets harder.

This isn't only about attack surface, but also enabling more user friendly tooling.