// fleet-ssh-hostcert — boot-time SSH host-certificate client (post-switch-root).
// Gets the host's per-boot ephemeral SSH host key signed by the fleet SSH CA via
// the enrol-broker host plane, authenticating with the TPM identity over mTLS —
// so admins trust every host via one `@cert-authority` line instead of per-boot
// TOFU (closes F-02 / POA&M P-17). Pure Go (go-tpm, no CGO), one static
// reproducible binary like fleet-enrol/fleet-agent; deps pinned by go.sum.
// See docs/ssh-host-certificate-design.md and files/ssh-hostcert/README.md.
module fleet-ssh-hostcert

go 1.26

require github.com/google/go-tpm v0.9.8

require golang.org/x/sys v0.8.0 // indirect