The key keeper is ssh-client's published package sshkeys, taken by series by the three build modules; Said, KindBuilder, ExecRunnerClean from the Delivery sdk (B5d; ADR 0634 §1; issue 1966)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

modules/ssh-client/cmd/ssh-client-tools/templates_test.go

@@ -62,6 +62,16 @@ func TestEveryFileTakesItsTextFromATemplate(t *testing.T) {
 	if packs != 1 {
 		t.Errorf("the build packs files/ into %d archives, not one", packs)
 	}
+	// The key keeper is this module's published package, taken by series (ADR 0634 §1).
+	published := false
+	for _, a := range m.Build.Artifacts {
+		if a["name"] == "sshkeys" && a["kind"] == "package" && a["series"] == "0.1" {
+			published = true
+		}
+	}
+	if !published {
+		t.Errorf("no package artifact sshkeys of series 0.1 in the build")
+	}
 }
 
 // Issue 955, area S2: the module keeps the keys state and requires the forge's account provision. It declares