FleetKey
A B2B SSH key and secrets manager for small engineering teams that ships with a minimal Linux askpass so non-engineering staff can approve deploys from a hardened laptop without ever touching the underlying keys.
IT leads at small companies who need deploy approvals from non-developer executives on locked-down laptops
- Web-based approval flow that triggers a local Wayland askpass on the approver's laptop
- Hardware-backed key custody — private keys never leave the TPM
- Audit log per approval tied to a specific deploy or release
- One-line installer for Ubuntu, Fedora, and Arch minimal desktops
The source post illustrates the fragility of SSH auth UX on minimal Linux; SMBs that standardize on Linux developer laptops need this solved.
Source HN thread was tiny (34 points / 9 comments), and SSH askpass remains a Linux-niche utility with very limited mainstream awareness, indicating weak grassroots demand for the specific 'non-engineer deploy approval via askpass' workflow.ssh-askpass (1) — Debian manpages ↗Install SSH Askpass on Linux — Snap Store ↗
SSH/secrets management is saturated: HashiCorp Vault, AWS/Azure/GCP Key Vaults, Doppler, Infisical, 1Password Secrets Automation, CyberArk Conjur, plus dedicated SSH CA tools (Teleport, Smallstep) all compete; only the 'minimal askpass UI for non-engineers' angle is underexplored.Top 8 Secrets Management Tools Compared (2026) ↗Best SSH Key Management Software | 2026 Expert Picks ↗
SMBs do pay for per-seat secrets tooling (Doppler $0–$21/user/mo, Vault up to $6,870/mo), but FleetKey's buyer is a thin IT-lead/exec-approver slice at small companies; willingness to pay for a wrapper around already-paid solutions is unproven.Doppler vs HashiCorp Vault Pricing (2026) ↗Secrets Management Pricing 2026: We Compared All 18 Tools ↗
Secrets sprawl is a durable, growing enterprise pain point and SSH key lifecycle remains unresolved industry-wide, but deploy-approval UX is trending toward web/Slack/ChatOps surfaces rather than desktop askpass binaries, reducing long-term relevance of this specific wedge.The Best Secrets Management Tools in 2026—and What Comes After ↗
A minimal GTK4 askpass plus a small SSH-agent/key-wrapping backend with audit/RBAC is buildable by a small team; askpass protocol is well-defined (exec'd by ssh-add with prompt on stdout), but 'hardened laptop' enforcement and secure key custody add real engineering and audit-burden work.ssh-askpass (1) — Debian manpages ↗SSH_ASKPASS: automatic key passphrases ↗