Get public key signed by e.g. Vault?

[hazcod]

Hi,

I was reading through your project since I am looking into something comparable for me.
However, in my case the public key needs to be signed by an external party (Hashicorp Vault).
So connecting to a SSH server that requires this requires the private key and the signed public key.
I was wondering how this would work if I adapt your project for this, e.g. adding the fetch signature step.
Would I store the signed public key in a temporary file or keep it in memory? I'm not sure what the purest ssh-agent approach is here, I'm thinking caching it in memory until the lifetime expires.

[FiloSottile]

You can use yubikey-agent with an SSH certificate by using the CertificateFile ssh_config option.