Most fleets start the same way: a public key in authorized_keys on every host, and perhaps a bastion in front. It works until someone leaves, a laptop is lost, or an auditor asks who could reach production last March.

The problem with static keys

With static keys every line is a standing trust relationship, stored on the host. The key of someone who left keeps working until somebody finds and removes it everywhere.

• Keys outlive their reason. A key added for one deployment is still trusted years later. Nothing expires unless someone remembers to remove it.
• Offboarding is a hunt. Removing a person means finding their key on every host, in every account. Miss one and they still have access.
• Access is invisible. authorized_keys tells you which keys work, not who holds them, why they were added, or whether anyone approved it.
• Production is just another host. Nothing in the mechanism distinguishes a demo box from the primary database.

What Shellius changes

Hosts trust one certificate authority. People hold certificates that expire, and revoking one person is a single action in one place.

	Static keys	Shellius
What a host trusts	Each individual public key	One certificate authority
Lifetime of access	Until someone deletes the key	The certificate's validity window, set by policy
Removing a person	Edit every host	Revoke once; the next connection is refused
Production	Same as everything else	Goes to an approver, unless a role may bypass — and that is audited
Record of access	Whatever sshd logged locally	Central, append-only audit log, plus SSH session recordings
Adding a host	Distribute everyone's keys to it	One bootstrap command

What it does not change

Shellius is honest about its edges:

• It is a new critical service. Hosts ask it about every login. If Shellius is down, certificate logins stop. Keep a break-glass path that does not depend on it.
• It does not replace your network. Shellius has no tunnelling. Something still has to be able to reach port 22 — either the Shellius host (browser sessions) or the user's machine (terminal client). See Network reachability.
• Some hosts cannot be bootstrapped. Appliances and machines you do not control cannot trust a CA. The Keystore exists for those, as a deliberate and audited exception.

Next steps

How Shellius worksThe certificate flow, end to end.QuickstartFrom nothing to a first certificate login.Threat modelWhat Shellius protects, and what it trusts.