Generate a dedicated key

Before choosing a tool or writing more code, make the requirement concrete. The VPS operator key is distinct from unrelated Git hosting and automation identities.

A key pair has a private signing key and a public key that servers may authorize; the private half stays on the client. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

A common failure is to reuse one unnamed private key for every service and device. The happy path may still work, which makes the mistake easy to miss. generate a dedicated supported key, label its purpose, protect the file, and back it up only according to policy. Keep the first version small enough that every important input and output remains visible.

This supports the module goal: Create a maintainable client identity setup without copying private keys or making authentication implicit. Capture the request, command, trace, screenshot, test result, or other evidence that proves the result.

Generate the key, inspect its fingerprint and public half, and prove the private half never leaves the client. Change one condition on purpose, predict the result, and compare the prediction with what actually happened.