The linux kernel (6.1 aka bookworm) provides a key retention service / keyring that allows safely storing and using keys.

We should track the evolution of the service as it could be pretty interesting for some use cases: acme-chief + cp servers. Sadly right now it doesn't support ECDSA so usage on cp servers is out of the question (yet).

links:

• https://blog.cloudflare.com/the-linux-kernel-key-retention-service-and-why-you-should-use-it-in-your-next-application
• https://docs.kernel.org/security/keys/core.html
• ECDSA support (not merged): https://patchwork.kernel.org/project/keyrings/cover/20221014100737.94742-1-ignat@cloudflare.com/