By Luffy Bao, CTO at Ankayma · 12 July 2026 · ← All writing
Ankayma is now on the App Store. The short version of what that means: an iPhone can join your mesh as a first-class node. It resolves your private domain names — names that don't exist on the public internet. It opens your internal services over HTTPS with a real certificate, with no port ever exposed to the world. And it can SSH into a production box, from a terminal inside the app, with no SSH key stored anywhere.
That last one is the part that sounds wrong, so let me argue it properly.
Your laptop's SSH key is a file. That's the whole problem. The key sitting in ~/.ssh on a laptop is a piece of data: it can be copied, backed up somewhere it shouldn't be, read by anything that runs with your user's permissions, and it stays valid until someone remembers to rotate it. Every "harden your SSH" guide is ultimately a list of ways to guard that file harder. The file is still there.
The phone takes a different route: the key never exists as a file at all. When you enroll an iPhone into the mesh — scan a QR code, confirm with Face ID — the device generates its key pair inside the Secure Enclave. That key cannot be exported. Not by the app, not by a backup, not by me. What travels is a certificate binding this device to this identity; what stays is hardware that will sign challenges only after a biometric check. This is the same mechanism your passkeys use. We apply it one layer down: not to log into one website, but to decide which machines can reach which machines at all.
So "SSH from a phone" is not a party trick — it's the stronger credential. When you open the in-app terminal and connect to a production server, the session is bound to the device identity, over an encrypted tunnel that exists only between your phone and that server. There is no bastion in the middle, no public port 22, and no key file anywhere in the chain. Needing root is a separate, deliberate step: the control plane issues a signed grant that lives at most 15 minutes, each elevated operation is logged, and the grant dissolves on its own. A phone that's lost or stolen is one revocation away from being nothing — the certificate dies, and every door it could open closes at once. Compare that honestly with recovering a leaked key file: you don't know where the copies are.
Private domains work the same way. You attach a name you own to a service running on any node — a dev box, a VPS, a Mac mini at home. Only devices inside your mesh can resolve that name; the system issues real TLS certificates automatically. From the iPhone, you open the URL and it loads — over a peer-to-peer tunnel, not through our infrastructure. The app can show you the path a connection actually took, because "the vendor is not on the data path" should be something you can check, not something you're asked to believe.
Now the part release announcements usually skip: what doesn't work yet.
My bias, stated plainly. I build this, so I naturally weigh "no key file anywhere" as worth more than "works on every platform on day one." You may weigh it the other way. The narrow claim I'll defend: a non-exportable, hardware-bound, biometric-gated key is a structurally better credential than a key file on a general-purpose laptop — and once you accept that, the phone in your pocket stops being the risky device and starts being the strongest one you own.
The app is free to try with your own devices — enroll two nodes and see whether the path proof convinces you. If you run infrastructure where this matters and you see a flaw in the argument — a topology it breaks on, a compliance requirement it can't meet — that's exactly the mail I want to receive.
Luffy Bao is CTO at Ankayma, building zero-trust mesh infrastructure for regulated organizations in Southeast Asia and the Gulf. Questions or counterarguments? hello@ankayma.com