ssh: prevent Apple from saving SSH key passphrases to invisible keychain
ssh: prevent Apple from saving SSH key passphrases to invisible keychain

This is astonishing:

  https://openradar.appspot.com/28394826

When you decrypt a private key, Apple silently saves it to a hidden
keychain (supposedly something under `Library/Keychains/$UUID/keychains-2.db`).
It is not visible in the Keychain UI. This survives across reboots,
which means that you can use private keys without a password.

You can try to delete it from this keychain using the undocumented option:

  ssh-add -dK

But you may get a (probably spurious) error message:

  Could not remove identity "/Users/glh/.ssh/id_rsa": agent refused operation

Adding the (undocumented):

  UseKeyChain no

Thwarts this behavior. It works in conjunction with:

  AddKeysToAgent yes

This gives you pretty close to the El Capitan behavior. I think the docs
for `AddKeysToAgent` are also likely misleading: it doesn't just mean
save to the `ssh-agent` but rather to this hidden DB as well.

See also:

  https://www.reddit.com/r/osx/comments/52zn5r/difficulties_with_sshagent_in_macos_sierra/

wincent/wincent,wincent/wincent,wincent/wincent,wincent/wincent,wincent/wincent,wincent/wincent,wincent/wincent,wincent/wincent