That's kind of the opposite of the approach presented here, though. With hardware-resident, non-exportable keys, you can know that no matter what you do, key hashes to some physical device are 1:1.

Whether you want or don't want that property is a different story.

is this for new machine installs , or periodic (daily , weekly) access?

I thought private keys were meant to be secret (not copied) and the public keys meant to be installed onto the target host.

so if you have a desktop, laptop etc, you would generate the secret once per endpoint and then copy the public keys onto targets as needed. AT scale this could be done by ldap / cloud mgmt.