we give you a nonce. you sign it with the key you already have.
printf '%s' '<nonce>' | ssh-keygen -Y sign -f ~/.ssh/id_ed25519 -n forge-auth -
that is stock openssh. nothing to install.
or barerepo auth <name>,
which does the same thing in one step.