is this for new machine installs , or periodic (daily , weekly) access?

I thought private keys were meant to be secret (not copied) and the public keys meant to be installed onto the target host.

so if you have a desktop, laptop etc, you would generate the secret once per endpoint and then copy the public keys onto targets as needed. AT scale this could be done by ldap / cloud mgmt.