Is there a use-case that allows for a client to upload their public key ? about subspace

[agonbar]

It shouldn't be hard to do. Extending the client configuration to be able to change parameters like keys or IPs and save them. Not having the private key would make the download of a ready to use file impossible tough.

[nhi-vanye]

I agree that it impacts the one-stop shop, but it keeps the private keys where they were intended to be - on the device.

I don't see a reason to not support both use cases.

An alternative might be to destroy the private keys (securely) after they were used. That would mean that any subsequent update to the client's configuration would need a new private key generated, but that's probably good practice anyway (making it automatic/easy to rotate device keys - which is something I think tailscale does)

[gilesw]

I've been wondering about this. I don't want to have to issue all new keys if someone in systems leaves as they'll have had access to all the private keys. I've tested it out it doesn't blow up so I think I'll put a cronjob in place to run sudo perl -pi -e 's/PrivateKey = .*/PrivateKey = YOU MUST MAKE A NEW PROFILE IF YOU LOST YOUR KEY/' *.conf