Hector Martin

Well, I'd imagine that most people will keep them on them and within their sight at all times. If they can be trusted to revoke the keys if they leave their sight, and if the owner of the key doesn't mind the end user having access - that'd probably be most of the threat model.

Using epoxy resin embedding w/ non-conductive glitter and photo identitifcation cards, it should be possible to create a tamper resistant case for microcontrollers which are otherwise physically insecure - given the above.

You can still voltage/clock glitch the things pretty easily through epoxy; if you need to disable decoupling capacitors that's pretty easy to do with a well-placed drill hole. TBH decapsulation isn't even that hard.

The point is they'd have to cause physical damage and the glitter would be impossible to replicate without extreme cost. It isn't to make the device tamper proof, just tamper resistant for a few minutes or so.

Yeah, but revoking PGP/SSH keys is less trivial, so a higher level of physical tamper resistance to key extraction is desirable depending on your use case.

Suggest certificate authentication with ssh if possible, with a key as fallback. But yes, the epoxy would help give you time to revoke (say a call to a twilio app or something) - and the primary protection is keeping the key on your person at all times.

you could produce a layered multi-PCB construction with a randomised protection grid within each multi-layer PCB the interruption of which would zeroise the microcontroller ... etc. etc. there are lots of possiblities here.