The Bitwarden desktop app has a built in SSH agent [1], which lets you store SSH keys inside Bitwarden. I have set the app to always ask me for confirmation when the key is requested.

[1] https://bitwarden.com/help/ssh-agent/

▲

InsidiousWombat 2 hours ago | parent | next [-]

you can make your SSH agent do that, no need to use bitwarden.

If you're using say yubikey for hardware ssh key (via gpg ssh agent/smartcard interface) you can also make it require physical touch of the key to confirm every operation

	▲	tylergetsay an hour ago \| parent \| next [-]
		If your machine has a TPM chip you can also use that and require a PIN to unlock it, with a mandatory lock out period enforced by the chip
	▲	rolosa an hour ago \| parent \| prev [-]
		How do I do it with touchid and a MacBook Air?

▲

petesergeant 2 hours ago | parent | prev [-]

1Password too, FWIW