Neat–I’d missed the CLI announcement. I’ll have to play with it. An oh-my-zsh plugin to wrap a bunch of services into op could be helpful here.
We moved some private keys into 1Password personal vaults for work when that came out. Regardless of one’s feelings about 1PW, I think they have the right idea generally moving computers on from ssh agent permissions being all-or-nothing with no confirmation steps.
I’m not sure–1password runs an ssh agent that replaces the system agent, so in that respect, yes, but I don’t know if it would pass the cert correctly (can’t test without doing some setup.) Also, it doesn’t seem to have a workflow to frequently renew the cert.
Somebody asked that on their forum and got this reply:
Thanks for testing! This is not a use case that we have considered and we will need to give it some thought. In the meantime, it should be possible by specifying an IdentityFile in SSH config that specifies the public key. I believe this will still pick up the certificate, but I have not tested.
To be honest the concept of SSH certificates instead of SSH keys is new to me…