ssh-agent decrypt

[Peter Moody]

moronic monday (pst) question time.

this may have been covered elsewhere, and emphatically shot down (and
if so, I apologize), but I'm interested in using ssh-agent to decrypt
data.

ssh certificates are the most secure user auth token we have, and even
though ssh certs aren't chainable, we routinely use them to assert
identity to things other than ssh (eg. if you can present a cert
that's signed by a known ca, and you can prove you have the private
key that belongs to the cert, we know who you are).

So it'd be nice to be able to give some data back to the client,
encrypted with the client's pubkey, that the client could then ask the
ssh-agent to decrypt using the corresponding private key. in the past,
we've generated a new keypair and sent the new pubkey with the
request, but that's a little clunky and it's as tightly bound to "one
source of truth" as if we could just rely on the key from the cert.

I'm guessing there's a dead simple reason something like this isn't
supported already. like, maintenance of code that only a weenie like
me would use or that it would enable some new class of cryto attacks
or something.

Cheers,
peter