I type commands into terminals all day. Last week it hit me that every keystroke I type produces claims, not proof — and that gap is the entire reason auditors exist.

The fear in one paragraph

When an operator says “I patched all forty servers,” the auditor hears three unanswered questions: was it really you (repudiation)? Did you edit the logs afterward (tampering)? Who approved it in the first place (attribution)? An “unsigned terminal” is any session that can’t answer those three. That’s what scares them — not the terminal, the deniability.

Signing in 60 seconds

Signing is not encrypting. Nothing is hidden; something is attested:

  1. Hash the content (SHA-384 is the quantum-safe minimum auditors accept without argument — the smallest hash that stays strong against quantum collision search).
  2. Sign the hash with your private key → signature blob.
  3. Verify with the public key → valid means the key-holder attests this exact content, unaltered.

Three properties fall out: authenticity (it was you), integrity (untouched), non-repudiation (you can’t deny it later).

The family, mapped once

Tool Signs with what
PGP Long-lived personal key, web-of-trust
SSH Your ~/.ssh key (also signs git commits)
Sigstore Keyless — short-lived cert bound to CI identity
Ed25519 The algorithm underneath most of the above

I learned this the concrete way: my own policy-as-code gateway is Sigstore-signed in CI, and my run ledger uses Ed25519. Same trilogy, different packaging.

The PSM twist

Here’s what surprised me: privileged session management delivers the same trilogy by process instead of math. No PGP anywhere — yet the auditor is satisfied. Why?

Approval ticket → vault checkout log → proxied session recording → independent replay → reviewer countersignature → archive. Each link is witnessed by a different party, so no single person can fake the chain. The countersigned review is the signature. My working hook:

Policy decides, cryptography proves, the session proxy witnesses.

One sentence per mechanism — that’s the whole cryptography story an operator ever needs on stage. Everything deeper (trust models, key ceremonies, post-quantum migration) is a Y2–3 consultant asset, not a prerequisite. Write the hook down once, never re-derive it.