Hi,

please consider providing a configurable hook option (useable from .ssh/config and/or -o) to invoke a binary before the actual ssh processing begins. This could for example be used to load a certain key into the agent or to query the user for a PIN needed for the HSM (in case the used library doesn't go interactive).

It is of course possible to wrap ssh, but having ssh do this itself greatly reduces the attach surface of a wrapper's command line processing and doesn't require the user to remember to call the wrapper instead.

Greetings
Marc