Regarding #81 (comment)

I've realized that the internal implementation of certificates in ssh-tpm-agent is a bit problematic and doesn't work the same way as ssh-agent so I suspect I need to do some larger changes.

Do you think the refactor would change the external behavior of this patch? If not, maybe you could merge the current changes with an alpha notice. Otherwise I'm perfectly fine just running a fork for now.

Also curious to hear what those differences from ssh-agent are? :-)

Do you think the refactor would change the external behavior of this patch? If not, maybe you could merge the current changes with an alpha notice. Otherwise I'm perfectly fine just running a fork for now.

I can merge my slight rewrite into master.

Also curious to hear what those differences from ssh-agent are? :-)

The implementation is done so that the SSHTPMKey struct contains both the public key and the certificate. It implies a 1-to-1 relationship between one public key, and one certificate. So multiple certificates for one key would not work very well. It also implies that the agent will do the wrong thing if you try to remove the key or the certificate from the keyring.

Effectively need to decouple this and ensure that the signer/key list contains both.