Sign arbitrary data with your SSH keys

This has been possible for a long time using a combination of OpenSSL and ssh.

To sign: openssl dgst -sha512 -sign ~/.ssh/id_rsa file > file.sig

To verify, needs converting the public key (who.pub) to something OpenSSL can grok:

ssh-keygen -e -f /tmp/who.pub -m pkcs8 > /tmp/who.openssl.pub

Then verify: openssl dgst -sha512 -verify /tmp/who.openssl.pub -signature file.sig file

What you get with this over monkeying around with openssl (other than having to deal with two tools with awful command line argument UX instead of just one) is that you can use ssh-agent to do the signing, which means you can also use tokens and such.

We use openssl to encrypt our passworddb using SSH pub keys. Works nice in scripts. Wonder why we need the new command line.