SECURITY: Encrypt payloads using target user's public key

[HenrikBengtsson]

Wish

Encrypt messages and data streams that meant for a single, specific user using the target user's public pico.sh SSH key.

Background

The pico.sh service supports querying the public keys of a specific user;

$ curl https://auth.pico.sh/pubkeys/alice

(This was added on 2026-01-22, cf. picosh/pico#199 (comment))

Tasks

• Which key to use when a user have multiple public keys?
• Should user's announce their public keys in the message board part of their posted messages?
  • only allow keys available on pico.sh
  • maybe a short digest hash code, which is sufficient to identify the key in case there are multiple?
• Add a once-per-session key validation, i.e. verify that the select public key works and then memoize the (user, public key) map
• ...?