Allow importing existing public keys into GitHub Apps

[joaopenteado]

Select Topic Area

Product Feedback

Body

Currently, it is only possible to request GitHub to generate a GitHub App private key for you and not import your existing public key into the system.

GitHub does not allow you to redownload a previously generated private key and already claims to store only the public key either way, so it makes no sense to not allow users to import their existing key. This already done with SSH keys and certificates, in which you can't actually request GitHub to generate a private key for you and must import your own.

Security benefits of allowing users to generate their own private keys include:

• Prevent bad actors that could be potentially snooping in the network and getting the private key (i.e. malicious browser extensions, proxies, malware, TLS inspecting MITM vendors, etc).
• Prevent bad actors from getting all newly generated keys in the event GitHub is partially compromised and the actor is capable of injecting code or intercepting the logic that generates new private keys for GitHub apps. As a matter of fact, it feels like GitHub is unnecessarily exposing itself to this risk, since it would be better to allow only key imports (like with SSH keys and certificates) and provide a client-side mechanism to create the keys in the frontend for convenience.
• It would allow developers to generate their keys within HSM/TPMs and import them into GitHub, effectively making key exfiltration impossible (or much harder).

Additional considerations

• Like with SSH keys and certificates, it would be necessary to prevent the same key to be registered with multiple GitHub apps at once.