Since I used MacBook with TouchID, I've been using SeKey (by Nicolas Trippar) to manage my SSH keys. It come with 2 advantages: the private keys are non-exportable and I will be asked for TouchID everytime a program needs SSH authentication. I'm happy with that setup because I won't worry about leaking my private keys and the authentication is quite convenience, until recently: the project is abandoned, no Apple Silicon build and macOS will end the x86 support soon. Then I found out macOS has enough material to provide the exact functionalities of SeKey, I created sekey.sh to reproduce those functionalities. It can create SSH keypair backed by Secure Enclave, delete the keypair, show created keypairs, export public key, add keys to SSH agent. I hope you find it useful if you have the same workflow as me.