Browsers exchange a short-lived ticket for a credential, SSH clients fetch a certificate; both are signed by this machine's key and nothing is kept there. webmux rotate-key on the machine revokes everything at once.
Browser credentials last 7 days. Save this machine to a passkey and one touch refreshes them, on any browser your password manager syncs to, without a ticket. The passkey's public key is certified by this machine; the certificates live inside the passkey (largeBlob). Nothing is stored here.
One command enrolls an SSH client: run it there within 10 minutes. It fetches a certificate for the key you connect with, through the relay, and prints what to do next. Nothing is kept here to revoke; webmux rotate-key on the machine invalidates every client.