we give you a nonce. you sign it with the key you already have.
printf '%s' '<nonce>' | ssh-keygen -Y sign -f ~/.ssh/id_ed25519 -n barerepo-auth -
that is stock openssh. nothing to install.
or br auth {{if .Name}}{{.Name}}{{else}}<name>{{end}},
which does the same thing in one step.