[ykonstant]

>- By comparison, Kerberos tickets on Linux reside as files on disk, SSH user & host keys reside as files on disk and loaded into sshd/gpg-agent memory, x.509 keypairs reside as files on disk & process memory etc etc. Wouldn't it be nice to have them protected somehow? To my knowledge, nothing exists for this on Linux.

I have always wondered about that; there has to be a more secure control method for those secrets.

[sofixa]

There is, the TPM. SSH keys can easily be stored and used from there.

[ykonstant]

I can do that as a user? With what utility?

[sofixa]

Yep: https://incenp.org/notes/2020/tpm-based-ssh-key.html