Protecting SSH Keys with macOS Secure Enclave (Native Approach)

macOS Sequoia and Tahoe now support native SSH keys generated inside the Secure Enclave, the chip-isolated security subsystem that keeps private keys from ever touching disk or memory. The setup uses the built-in `sc_auth` command to create a non-exportable P-256 identity, optionally gated by Touch ID so each authentication requires biometric approval. The author tested the approach and found it fully functional but aesthetically rough, ultimately opting against it while still endorsing it as a viable option. The move matters because it gives Mac users hardware-backed SSH protection without third-party apps or extra hardware like a YubiKey. Alternatives include the Secretive app, YubiKey FIDO2 keys, and vault-based agents from 1Password and Bitwarden, the latter now offering SSH key support even on its free tier. What to watch next is whether Apple polishes the native workflow enough to make it the default choice for developers.