Ssh key audit

It reads every key pair in your .ssh folder for its type, file permissions, and whether the private key has a passphrase. It reads your .ssh config to see which keys are actually used, lists GPG keys with the days left before they expire, checks the ssh-agent, and walks your local git clones to learn which SSH hosts you really push to. Then it reports keys nothing refers to, keys with no passphrase, key files other people can read, config entries pointing at a key that no longer exists, expired signing keys, and hosts you use with no key set up. Your key material is never read, parsed, or printed. Read only, no credentials, no network. Use it for key rotation planning: it tells you which keys are unused and safe to remove and which are close to expiry. A missing gpg, an empty ssh-agent, or a check it could not complete is reported as an explicit unknown, never as a pass, and your key ma