The key keeper is ssh-client's published package sshkeys, taken by series by the three build modules; Said, KindBuilder, ExecRunnerClean from the Delivery sdk (B5d; ADR 0634 §1; issue 1966)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

modules/ssh-client/cmd/ssh-client-tools/sweep_test.go

@@ -13,7 +13,7 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/forgekey"
+	"git.novox.be/novox/mesh-catalog/modules/ssh-client/sshkeys"
 )
 
 // ADR 0415, issue 1017: the sweep keeps ~/.ssh to what this module knows and moves the rest out.
@@ -75,7 +75,7 @@ func TestSweepKeepsWhatItKnows(t *testing.T) {
 		t.Fatal(err)
 	}
 	for _, rel := range []string{"config", "known_hosts", "authorized_keys", "config.d/00-mesh", "config.d/10-forge",
-		forgekey.KeyFile, forgekey.KeyFile + ".pub", "id_ed25519", "id_ed25519.pub", "work_key", "work_key.pub", "work_key-cert.pub", "agent_only.pub", "removed-drone-20261004/id_drone", "authorized_keys2", "id_token"} {
+		sshkeys.KeyFile, sshkeys.KeyFile + ".pub", "id_ed25519", "id_ed25519.pub", "work_key", "work_key.pub", "work_key-cert.pub", "agent_only.pub", "removed-drone-20261004/id_drone", "authorized_keys2", "id_token"} {
 		if !exists(filepath.Join(dir, rel)) {
 			t.Errorf("%s was moved; it is known", rel)
 		}