The detail for this task — a cross-host audit of ~john/.ssh/authorized_keys on pomelo, kelp, gravlax and radagast, with fingerprints and per-key dispositions — has been moved to the private notes store because it maps which key reaches which host (host-access topology). See the private note of the same key: infrastructure/authorized-keys-remediation at https://www.critchley.biz/private/infrastructure/authorized-keys-remediation.
Summary only: the four hosts have accumulated too many keys (weak/stale RSA, duplicates, a passphrase-lost key still authorized on two hosts, and several different keys all sharing the comment admin@kelp). root@winky has already been removed from pomelo (host decommissioned). Remaining pruning is tracked in the private note.
Parent: TODO.