ssh user certs in home-manager

modules/features/ssh/default.nix

@@ -65,10 +65,6 @@ in
           then adminJwkPath
           else null;
       };
-      userScripts = mkUserScripts {
-        inherit cfg pkgs;
-        provisionerPasswordFile = adminJwkPath;
-      };
       CAknownHosts = (lib.genAttrs caPatterns (_: {
         certAuthority = true;
         publicKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
@@ -157,10 +153,6 @@ in
         home-manager.users.root = lib.mkIf cfg.certificates.user.enable {
           home.stateVersion = lib.mkDefault config.system.stateVersion;
           imports = [ inputs.self.modules.homeManager.ssh-new ];
-          home.packages = [
-            userScripts.sign
-            userScripts.check
-          ];
           ssh-new.certificates.user.enable = true;
         };
       };
@@ -169,6 +161,10 @@ in
   flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
+      userKeyPath =
+        if lib.hasPrefix "/" cfg.user.keyFile || lib.hasPrefix "~/" cfg.user.keyFile
+        then cfg.user.keyFile
+        else "${config.home.homeDirectory}/.ssh/${cfg.user.keyFile}";
       hasAdminJwk = lib.hasAttrByPath [ "sops" "secrets" "janus/admin_jwk" ] config;
       adminJwkPath = if hasAdminJwk then config.sops.secrets."janus/admin_jwk".path else null;
       hostScripts = mkHostScripts { inherit cfg pkgs; };
@@ -186,16 +182,11 @@ in
       config = {
         home.file.".ssh/known_hosts" = lib.mkIf cfg.certificates.user.enable {
           text = knownHostsText;
+          force = true;
         };
-        home.packages = [
+        home.packages = lib.optionals cfg.certificates.user.enable [
           userScripts.sign
           userScripts.check
-        ]
-        ++ lib.optionals cfg.host.enable-scripts [
-          hostScripts.sign
-          hostScripts.renew
-          hostScripts.renewalCheck
-          hostScripts.check
         ];
         programs.ssh = {
           enable = true;
@@ -216,7 +207,7 @@ in
                   PasswordAuthentication = "no";
                   PreferredAuthentications = "publickey";
                   IdentitiesOnly = true;
-                  IdentityFile = cfg.user.keyFile;
+                  IdentityFile = userKeyPath;
 
                   StrictHostKeyChecking = "accept-new";
                   UserKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts";
@@ -232,7 +223,7 @@ in
               # SSH certificate settings
               ++ lib.optionals cfg.certificates.user.enable [
                 {
-                  CertificateFile = "${cfg.user.keyFile}-cert.pub";
+                  CertificateFile = "${userKeyPath}-cert.pub";
                 }
               ]
             );