diff --git a/.gitignore b/.gitignore
index 181d38639..1b08275fd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,3 +22,6 @@ node_modules/
 .DS_Store
 desktop.ini
 .directory
+
+# Jetbrains .idea/ folder
+.idea/
diff --git a/keychain/README.md b/keychain/README.md
new file mode 100644
index 000000000..2d0fc33f1
--- /dev/null
+++ b/keychain/README.md
@@ -0,0 +1,67 @@
+---
+title: Funtoo:Keychain
+homepage: https://www.funtoo.org/Funtoo:Keychain
+tagline: |
+  Keychain helps you to manage SSH and GPG keys in a convenient and secure manner.
+---
+
+To update or switch versions, run `webi keychain@stable` (or `@v2`, `@beta`,
+etc).
+
+### Files
+
+These are the files / directories that are created and/or modified with this
+install:
+
+```text
+~/.config/envman/PATH.env
+~/.local/bin/keychain
+~/.local/opt/keychain-v*.*.*/
+```
+
+## Cheat Sheet
+
+> `keychain` helps you to manage SSH and GPG keys in a convenient and secure
+> manner. It acts as a frontend to ssh-agent and ssh-add, but allows you to
+> easily have one long-running ssh-agent process per system, rather than the
+> norm of one ssh-agent per login session.
+
+### Quick start
+
+The following assumes that you have an RSA key pair named `id_rsa`
+
+Add the following to your `~/.bash_profile`
+
+```sh
+eval `keychain --eval id_rsa`
+```
+
+### Multiple keys
+
+The following assumes that you have an RSA key pair named `id_rsa` and a GPG key
+with ID `1A2B3C4D5E6F7890`
+
+Add the following to your `~/.bash_profile`
+
+```sh
+eval `keychain --eval id_rsa 1A2B3C4D5E6F7890`
+```
+
+### Finding your gpg key id
+
+```sh
+gpg --list-secret-keys --keyid-format=long
+```
+
+will output something like
+
+```
+/home/your-user/.gnupg/pubring.kbx
+---------------------------------
+sec   ed25519/1A2B3C4D5E6F7890 2025-06-10 [SC]
+      ABCDEF0123456789ABCDEF011A2B3C4D5E6F7890
+uid                 [ultimate] John Doe <john.doe@example.com>
+ssb   cv25519/9876543210ABCDEF 2025-06-10 [E]
+```
+
+In this example your GPG key id would be `1A2B3C4D5E6F7890`
diff --git a/keychain/install.sh b/keychain/install.sh
new file mode 100644
index 000000000..ab166c86a
--- /dev/null
+++ b/keychain/install.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+
+# shellcheck disable=SC2034
+# "'pkg_cmd_name' appears unused. Verify it or export it."
+
+__init_keychain() {
+    set -e
+    set -u
+
+    ####################
+    # Install keychain #
+    ####################
+
+    # Every package should define these 6 variables
+    pkg_cmd_name="keychain"
+
+    pkg_dst_cmd="$HOME/.local/bin/keychain"
+    pkg_dst="$pkg_dst_cmd"
+
+    pkg_src_cmd="$HOME/.local/opt/keychain-v$WEBI_VERSION/bin/keychain"
+    pkg_src_dir="$HOME/.local/opt/keychain-v$WEBI_VERSION"
+    pkg_src="$pkg_src_cmd"
+
+    # pkg_install must be defined by every package
+    pkg_install() {
+        # ~/.local/opt/keychain-v0.99.9/bin
+        mkdir -p "$(dirname "${pkg_src_cmd}")"
+
+        # mv ./keychain ~/.local/opt/keychain-v0.99.9/bin/keychain
+        mv ./keychain "${pkg_src_cmd}"
+    }
+
+    # pkg_get_current_version is recommended, but not required
+    pkg_get_current_version() {
+        # 'keychain --version' has output in this format:
+        # <empty-line>
+        # * keychain 2.8.5 ~ http://www.funtoo.org
+        #
+        #   Copyright 2002-2006 Gentoo Foundation;
+        #   Copyright 2007 Aron Griffis;
+        #   Copyright 2009-2017 Funtoo Solutions, Inc;
+        #   lockfile() Copyright 2009 Parallels, Inc.
+        #
+        # Keychain is free software: you can redistribute it and/or modify
+        # it under the terms of the GNU General Public License version 2 as
+        # published by the Free Software Foundation.
+        #
+        # and is redirected to stderr
+        # This trims it down to just the version number:
+        #       2.8.5
+        keychain --version 2>&1 |
+            head -n 2 |
+            tr -d '\n' |
+            sed 's/^[[:space:]]*//;s/[[:space:]]*$//' |
+            cut -d' ' -f3
+    }
+
+}
+
+__init_keychain
diff --git a/keychain/releases.js b/keychain/releases.js
new file mode 100644
index 000000000..fbbcfe862
--- /dev/null
+++ b/keychain/releases.js
@@ -0,0 +1,39 @@
+'use strict';
+
+var github = require('../_common/github.js');
+var owner = 'funtoo';
+var repo = 'keychain';
+
+let Releases = module.exports;
+
+Releases.latest = async function () {
+  let all = await github(null, owner, repo);
+
+  // Set each release package to posix_2017 since they are shell scripts
+  // that can run on any POSIX-compliant system
+  for (let pkg of all.releases) {
+    pkg.os = 'posix_2017';
+    pkg.arch = 'ANYARCH'; // Since it's a shell script, it works on any architecture
+    pkg.libc = 'none'; // No libc dependency since it's a shell script
+    pkg.ext = ''; // No extension since it's a plain shell script
+  }
+
+  return all;
+};
+
+Releases.sample = async function () {
+  let normalize = require('../_webi/normalize.js');
+  let all = await Releases.latest();
+  all = normalize(all);
+  // just select the first 5 for demonstration
+  all.releases = all.releases.slice(0, 5);
+  return all;
+};
+
+if (module === require.main) {
+  (async function () {
+    let samples = await Releases.sample();
+
+    console.info(JSON.stringify(samples, null, 2));
+  })();
+}
diff --git a/test/install.sh b/test/install.sh
index 7e0b4bcb7..80dcf1c9e 100644
--- a/test/install.sh
+++ b/test/install.sh
@@ -43,6 +43,7 @@ __rmrf_local() {
                 iterm2-utils \
                 jq \
                 k9s \
+                keychain \
                 keypairs \
                 kind \
                 koji \
@@ -139,6 +140,7 @@ __rmrf_local() {
                 iterm2-utils \
                 jq \
                 k9s \
+                keychain \
                 keypairs \
                 kind \
                 koji \
@@ -238,6 +240,7 @@ __test() {
         iterm2-utils \
         jq \
         k9s \
+        keychain \
         keypairs \
         kind \
         koji \