(untitled)

Reading up on opkssh, which basically ties SSH into OAuth by using the hash of an SSH pubkey as a nonce that then gets baked into an OAuth token, which you can then embed into a self-signed SSH certificate and the remote end can extract that, verify the token signature, verify the token identity, and verify that the nonce in the token matches the hash of the pubkey, and… wait you can extend this…