The key keeper is ssh-client's published package sshkeys, taken by series by the three build modules; Said, KindBuilder, ExecRunnerClean from the Delivery sdk (B5d; ADR 0634 §1; issue 1966)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

modules/ssh-client/cmd/ssh-client-tools/sweep.go

@@ -22,20 +22,20 @@ import (
 	"syscall"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/forgekey"
+	"git.novox.be/novox/mesh-catalog/modules/ssh-client/sshkeys"
 )
 
 // Declared are the paths under ~/.ssh this module declares (module.json) or its own process makes
 // (keykeeper.go). A test checks the manifest against this list.
 var Declared = map[string]bool{
-	"config":                  true,
-	"known_hosts":             true,
-	"config.d":                true,
-	"config.d/00-mesh":        true,
-	"config.d/10-forge":       true,
-	forgekey.KeyFile:          true,
-	forgekey.KeyFile + ".pub": true,
-	"authorized_keys":         true,
+	"config":                 true,
+	"known_hosts":            true,
+	"config.d":               true,
+	"config.d/00-mesh":       true,
+	"config.d/10-forge":      true,
+	sshkeys.KeyFile:          true,
+	sshkeys.KeyFile + ".pub": true,
+	"authorized_keys":        true,
 }
 
 // SSHReads are the files ssh and sshd read in ~/.ssh by themselves, though this module writes none of
@@ -373,7 +373,7 @@ func publicKey(path string) bool {
 		return false
 	}
 	line, _, _ := strings.Cut(string(raw), "\n")
-	if _, err := forgekey.ParseKeyLine(line); err == nil {
+	if _, err := sshkeys.ParseKeyLine(line); err == nil {
 		return true
 	}
 	f := strings.Fields(line)