Secretive

Secretive is an app for protecting and managing SSH keys with the Secure Enclave. Keys kept in the Secure Enclave cannot be exported by design, which makes them harder for malicious users or malware to copy than keys stored on disk.

It is for developers and administrators who use SSH on a Mac. Keys can require Touch ID or Apple Watch authentication before they are used, Secretive notifies you whenever your keys are accessed, and Macs without a Secure Enclave can use a Smart Card such as a YubiKey for signing.

Highlights

• Keys stored in the Secure Enclave cannot be exported
• Optional Touch ID or Apple Watch authentication before a key is used
• Notifications whenever your keys are accessed
• Smart Card support, such as a YubiKey, for Macs without a Secure Enclave
• Secure Enclave keys are specific to each Mac and cannot be backed up or transferred
• Builds produced by GitHub Actions with an auditable process and attestations