Secretive should do this. It generates a key inside the secure enclave, and you can set it to require TouchID, so you know whenever it's used. Keys can't be exported either.

you can generate a key in the secure enclave then use that with touchid every time to authenticate - see eg. https://nmattia.com/posts/2026-10-19-setting-up-ssh-keys-tou...