SSH key expiration lacks automatic revocation policy in Sourcetree

Sourcetree's SSH key management stores private keys in the system keyring or plaintext without built-in expiration or rotation metadata, creating a credential lifecycle gap for environments that enforce least-privilege access policies. When an SSH key expires, the application either prompts for a password or fails the connection, with no automatic revocation or update workflow triggered from within the Manage SSH Keys dialog. Similarly, HTTPS credential helpers can be configured but Sourcetree does not enforce least-privilege token scopes, storing full-access tokens that may exceed required permissions.

This behavior raises questions about how the client can integrate with external identity management systems while maintaining secure, time-bounded access. What mechanisms could Sourcetree adopt to surface credential expiration status? Should the key management interface incorporate validity periods? How should HTTPS token scopes be constrained without disrupting existing repository workflows?