interesting subject, but I cannot what you mean by "truly secret-less".

With an ordinary SSH with a private public key in .ssh it is, isn't? but you want to allow cloud credentials, so you do not want (you consider it a secret) have a certificate in remote machines (as I do with cloudflare warp)