Enable signing operations via OS native cryptographic stores

[bgshacklett]

Is your feature request related to a problem? Please describe.
I'm trying to sign application packages as part of my Gulp workflow while keeping the private key stored as securely as possible.

Describe the solution you'd like
I would like to be able to generate/store cryptographic key pairs using a secure cryptographic storage facility such as the Keychain on macOS, the Certificate Store on Windows or GNOME keyring on Linux.

Using an OS-Level storage mechanism would allow for storing the keys/key-pairs in a single location while retaining access to them in multiple development environments.

Describe alternatives you've considered

• Store keys in my home directory using password-based encryption
• Sign code outside of the Node.js environment
• Create native add-ons which interact with the OS-level facilities for use with a custom module
• Create a custom module which "shells out" to OS-provided binaries to perform the signing operations

Other Notes
This functionality was discussed in #15113. I'm raising this request in hopes that it may be more easily tracked outside of an already-closed issue.

[ChALkeR]

using a secure cryptographic storage facility such as the Keychain on macOS, the Certificate Store on Windows or GNOME keyring on Linux.

@bgshacklett This type of OS/DE integration is better to be implemented as an ecosystem package -- because of high level of dependency on outside APIs that could change rapidly it would make sense to have separate versioning for such a wrapper. E.g. it would be a problem maintaining something like this in Node.js LTS version, and it could quickly get broken because of DE changes.

In short -- it is a good idea to implement something like that, but it shouldn't be a part of Node.js core. Heavy -1 to something like this in core.

Is there some npm package that already does that?

[bnoordhuis]

Since no one else chimed in I'll take the liberty of closing this out. I agree with @ChALkeR's assessment that it would probably turn into a maintenance drag.

Aside: at least for GNOME Keyring, you could implement it as a pure JS module by talking Secret Service over D-BUS. Might be a fun weekend project.