docs/kvm-provider.md walks through key generation, ssh-copy-id, ssh-keyscan under the address the operator dials, and the Secret from the private key plus ~/.ssh/kvm_known_hosts. make kvm-ssh-secret runs the same as an apply with KVM_SSH_KEY / KVM_KNOWN_HOSTS overrides and refuses a .pub, the classic mistake. README mirrors the short form. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>