Your server panel holds root on all your servers. Does that bother anyone else?

Classic server panels work the same way. Their backend holds an SSH key or runs an agent with root, and it can execute anything on your servers. If the panel's backend gets compromised, every server connected to it is compromised too.

We built Servor around the opposite rule. Your private key stays in your browser. Every command you send is signed there with Ed25519, and the agent on the server checks the signature before it runs anything. A command sent to 20 servers gets 20 signatures, one per server, so a signature can't be replayed on another machine.

Our API only relays the signed command. It can't alter it, because the signature would no longer match. That's also why we never wrap a command on the server side with sudo, cd or anything else.

How do you handle this today? Do you trust your panel, use a bastion, or stick to plain SSH?