Security●●Solid
Post-quantum signing keys that never leave the iPhone's Secure Enclave
Hardware-backed ML-DSA signing on iOS when most PQ libs are still software-only.
Niche GemBig Brain
jcaso
1012d ago
Back to browse
GitHub Repository
A, Go, crypto.Signer backed by a TPM key, so crypto/tls can authenticate with a key that never leaves the hardware.
2 starsGo
MTLS with keys never leaving the TPM
by alexpadula·Jul 26, 2026·2 points·1 comment
AI Analysis
●●●BangerWizardryNiche Gem
Keys never touch RAM, solving the software extraction vulnerability TPMs were meant to prevent.
Strengths
- •Implements crypto.Signer interface so standard Go TLS stacks work without custom dialers.
- •Auto-discovers key handles by matching certificates, removing fragile machine-specific config.
- •Explicitly documents RSA-PSS salt length mismatches, saving users hours of cryptic handshake debugging.
Weaknesses
- •Does not provision keys, requiring a separate attestation agent to generate and certify them first.
- •TPM serialization limits new handshakes per second, making it unsuitable for high-churn short-lived connections.
Category
Target Audience
Systems engineers and security architects building zero-trust infrastructure
Similar To
aws-nitro-enclaves · hashicorp-vault-transit · smallstep-tpm
Similar Projects
Security●●Solid
Cardea, SSH bastion with per-key ACLs, TPM keys and session recording
File-based ACLs reviewable in PRs beat database-backed bastions for small teams.
Big BrainNiche Gem
hectorm
104mo ago
Security●●●Banger
Cardea, SSH bastion with per-key ACLs, TPM keys and session recording
SSH bastion with per-key ACLs, zero database, TPM-backed host keys—rules live in Git.
WizardryNiche Gem
hectorm
404mo ago
AI/ML●●Solid
LokalBot – meetings, notes, and autocomplete that never leave your Mac
Verifiable privacy: run lsof during meetings and see zero network connections.
Solve My ProblemNiche Gem
stevyhacker
1025d ago
Security●●●Banger
OneCLI – OSS credential gateway that keeps secrets out of AI agents
Network-layer proxy that injects secrets per request so agents never actually hold the keys.
Big BrainSolve My Problem
Jonathanfishner
108323d ago
Security●●●Banger
SSH-TPM-agent · Release v0.9.0
Hardware-bound SSH keys sealed in TPM without messy PKCS11 config.
WizardrySolve My Problem
Foxboron
632mo ago