CREATE TABLE ssh_keys (
    id TEXT PRIMARY KEY CHECK (length(id) = 36),
    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    fingerprint TEXT NOT NULL UNIQUE
        CHECK (
            length(fingerprint) = 50
            AND substr(fingerprint, 1, 7) = 'SHA256:'
            AND substr(fingerprint, 8) NOT GLOB '*[^A-Za-z0-9+/]*'
        ),
    key_type TEXT NOT NULL
        CHECK (key_type IN (
            'ssh-ed25519',
            'ecdsa-sha2-nistp256',
            'ecdsa-sha2-nistp384',
            'ecdsa-sha2-nistp521',
            'ssh-rsa',
            'sk-ssh-ed25519@openssh.com',
            'sk-ecdsa-sha2-nistp256@openssh.com'
        )),
    key_data BLOB NOT NULL CHECK (length(key_data) > 0),
    label TEXT NOT NULL CHECK (length(CAST(label AS BLOB)) <= 128),
    added_at INTEGER NOT NULL
) STRICT;

CREATE INDEX ssh_keys_user_id_idx ON ssh_keys(user_id, added_at, id);