feature(git): add kryptons ssh key as signing key

Reviewed-on: #94

INSTALLATION.md

@@ -149,6 +149,23 @@ $ sudo sbctl enroll-keys
   Don't force it, either trust exactly those with `--tpm-eventlog` or
   microsoft's keys with `--microsoft`. Without either, the firmware may not
   start the device, in the worst case the machine doesn't boot at all.
+- Check what sbctl found first, a real option ROM has a PCI device path:
+```bash
+$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
+```
+- Paths starting with `0407` (firmware volume) are drivers from the firmware
+  itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
+  exactly those, after a firmware update they may need to be enrolled again
+  (disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
+- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
+  setup too, use `--microsoft` there, a refused gpu means no picture at all
+- On the Framework (krypton), keep the firmware's built-in OEM certificates
+  with `--firmware-builtin`, vendor firmware updates may need them. If an
+  update fails or the keys were enrolled without them, erase the keys in the
+  firmware again (Setup Mode) and re-enroll:
+```bash
+$ sudo sbctl enroll-keys --firmware-builtin
+```
 
 6. enable Secure Boot in the firmware and set a firmware password, then check
 ```bash

hosts/argon/configuration.nix

@@ -12,6 +12,7 @@
     ../../modules/nixos/data-drives.nix
     ../../modules/nixos/gnupg.nix
     ../../modules/nixos/greetd.nix
+    ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix
@@ -23,6 +24,7 @@
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
     ../../modules/nixos/thunar.nix
+    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];

hosts/neon/configuration.nix

@@ -17,6 +17,7 @@
     ../../modules/nixos/certificates.nix
     ../../modules/nixos/docker.nix
     ../../modules/nixos/gnupg.nix
+    ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix
@@ -28,6 +29,7 @@
     ../../modules/nixos/services.nix
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
+    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];

modules/home-manager/git.nix

@@ -14,6 +14,7 @@ let
   signingKeys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5BI+rirjPHZwqgBzO3xOi3m0+07zY0uEou7NSCFh0+ aaron@krypton"
   ];
 in
 {

modules/home-manager/programs.nix

@@ -7,6 +7,7 @@
     discord
     fastfetch
     keepassxc
+    signal-desktop
     teamspeak6-client
     typst
     zathura