diff --git a/assets/ssh-ca.pub b/assets/ssh-ca.pub
new file mode 100644
index 0000000..40806fa
--- /dev/null
+++ b/assets/ssh-ca.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINXEk6EKWoWsxVDX2sf13N7zSdvz+7NMZIFTUjt1gcG1 TINK
diff --git a/assets/ssh-krl b/assets/ssh-krl
new file mode 100644
index 0000000..7f5f45b
Binary files /dev/null and b/assets/ssh-krl differ
diff --git a/configure.sh b/configure.sh
index 313e12c..1dcea71 100755
--- a/configure.sh
+++ b/configure.sh
@@ -14,7 +14,11 @@ configure(){
     echo -e "APT::Install-Recommends "0";
 APT::Install-Suggests "0";" | tee /etc/apt/apt.conf.d/01norecommend >/dev/null
 
+    cp "$AWD/assets/ssh-ca.pub" /etc/ssh
+    cp "$AWD/assets/ssh-krl" /etc/ssh
     sed -i "s/.*PermitRootLogin.*/PermitRootLogin prohibit-password/g" /etc/ssh/sshd_config || true
+    sed -i "s/.*TrustedUserCAKeys.*/TrustedUserCAKeys /etc/ssh/ssh-ca.pub/g" /etc/ssh/sshd_config || true
+    sed -i "s/.*RevokedKeys.*/RevokedKeys /etc/ssh/ssh-krl/g" /etc/ssh/sshd_config || true
     sed -i "s/.*Host \*.*/Host \*/g" /etc/ssh/ssh_config
     sed -i "/.*HashKnownHosts.*/d" /etc/ssh/ssh_config
     sed -i "/.*HostKeyAlgorithms.*/d" /etc/ssh/ssh_config