Reimplement in Another Language

When the first draft of this scripting was written, it was much more minimal - do a single read from EC2 Instance Metadata service, parse out timestamp and key body, and return unexpired keys.

As time has gone on and security pieces have been added - instance ID checks, key signing, signing certificate verification, verification the script is running on an instance - this has drastically increased in complexity to the point where shell scripting is no longer appropriate. At this point, both internal to Amazon and external from distribution vendors, public comments, etc, there is a broad, general agreement this needs re-implementation in a proper language. Furthermore, continuing to iterate without shifting to a different language has proven a major pain to developers and maintainers and will only cause further pain as time goes on.

General Language Arguments:
* While static languages would require additional build complexity, they avoid the issue of needing various library dependencies installed on the system, thus reducing install complexity and scope (particularly for private subnets where standard repositories may not be available)
* Dynamic languages need to have access to dependency libraries and interpreter startup time must be minimal to avoid customer-notable latency at ssh time

Start by reviewing the existing shell script and tracing the EC2 Instance Metadata read, key parsing, expiration handling, instance ID checks, signing, certificate verification, and instance verification described here. Done would require an agreed replacement language and a complete reimplementation that preserves these security behaviors, but the issue does not name files, tests, or a target language.

Written by the indexing model from the issue text.