Integrating with Google Cloud is a pick 2 of 3 situation:

1. No long-lived keys
2. Easy setup
3. Safe from suspension

I'm really disappointed in Google for artificially disincentivizing the secure options. 4/4

Alternative one is have the customer create a service account and share a key with SSLMate - easy but less secure because long-lived keys are bad.

Alternative two is OpenID Connect which is secure but Google has made unnecessarily hard to set up. 3/4

SSLMate's solution (we create a service account for each customer) is easy AND secure and worked great for 5 years until we started getting hit with suspensions. 2/4

Turns out Alpine Linux has a copy of the same script from curl! I've raised an issue in their issue tracker: gitlab.alpinelinux.org/alpine/ca-ce...