SSH needs a path into the machine; that is why bastions exist. Invert the direction: a daemon on the server dials out, sealed end to end, and the box answers from your phone while staying behind NAT or a VPN.
An SSH app gives you a new session, not the one you left on your desk. What it takes to continue the same live session from a phone: an encrypted mirror, a touch-first viewer, and typing that lands in the real shell.
Keys are born on your devices, every frame is sealed before the network, and the relay stores ciphertext it cannot read. The whole path, from keystroke to browser, and why TLS alone is not enough.
Sessions die because the shell's lifetime is tied to a window or a connection. A local daemon and an encrypted mirror decouple them, and what a reboot honestly does and does not destroy.
A key pasted into chat is access you can never take back. The connection vault shares a wrapped key instead: X25519, Argon2id, revocation by deleting a wrap, and a server that sees only ciphertext.