Great explanation, thank you. Thinking about them in terms of PKI and SSH keys finally clicked for me.