fob

fob generates SSH keys inside the Mac's Secure Enclave, so no usable private key file sits in ~/.ssh. Each SSH login, Git push or pull, and commit signature asks for Touch ID, Apple Watch or the account password, and the prompt names the verified host it is connecting to.

Keys can be pinned to a single host, a short touch-reuse window covers bursts of Git commands, and a hash-chained log records every decision. A menu bar app and a command-line tool guide setup and migration of existing hosts, and a read-only checkup reports risky SSH configuration. It requires macOS 13 and installs from the project's Homebrew tap or GitHub releases.