# 1. Identify your key files (common names: id_ed25519, id_rsa)
ls -la ~/.ssh

# 2. Check the public-key fingerprint so you can verify the backup later
ssh-keygen -lf ~/.ssh/id_ed25519.pub

# 3. Create an encrypted backup archive containing only this key pair
tar -C "$HOME" -czf - .ssh/id_ed25519 .ssh/id_ed25519.pub \
  | gpg --symmetric --cipher-algo AES256 --output "$HOME/id_ed25519-backup.tgz.gpg"

# 4. Restrict access to the resulting backup file
chmod 600 "$HOME/id_ed25519-backup.tgz.gpg"

gpg --decrypt "$HOME/id_ed25519-backup.tgz.gpg" \
  | tar -xzf - -C "$HOME"

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

# Confirm the restored public key has the expected fingerprint
ssh-keygen -lf ~/.ssh/id_ed25519.pub