If you have an SSH key, you can use it to sign in. Put your public key on your website, and link to it from your home page with rel="ssh-key":
<link rel="ssh-key" href="/ssh.pub">
The file can be your id_ed25519.pub as it is, an authorized_keys file, or a list of fingerprints like SHA256:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU (the output of ssh-keygen -lf ~/.ssh/id_ed25519.pub), one per line. Since the keys you've added to GitHub are published at https://github.com/username.keys, you can link straight to that instead.
Ed25519, ECDSA and RSA keys work, as do keys on a hardware security key.
When you sign in, there are two ways to prove the key is yours: connect with ssh, or sign a challenge and paste it in.
sshStart signing in on the website as usual. When the sign-in page asks for your SSH key, leave it open and run:
ssh yourdomain.com@ssh.indielogin.com
using your own domain, without https:// (a leading www. doesn't matter). Your SSH client offers your keys, the same way it does when you log in to a server, including keys held by ssh-agent or a password manager. One of them has to be listed in your file; to use a particular key, add -i and its path.
The first time you connect, ssh asks you to confirm the server's key. Its fingerprint should be SHA256:Gb3VkbgH0DeEv127yjhgEmkZ31O0k7EGA+ARxbUu+z8.
Then it shows what you're about to sign in to:
IndieLogin.com Sign in to https://app.example/ as https://yourdomain.com/ started 20 seconds ago from 203.0.113.7 with your key SHA256:… Press Enter to confirm, or Ctrl-C to cancel.
Check that it's the sign-in you just started: the application, when it started and the address it started from. Press Enter, and the sign-in page carries on by itself.
If more than one sign-in is waiting for your domain, perhaps because you have two tabs open, or someone else started signing in as you at the same time, it doesn't pick one. It asks for the code shown on your sign-in page instead. You can also use that code in place of your domain: ssh k7f2-9qxm@ssh.indielogin.com.
If none of your keys is accepted, ssh tells you why: no sign-in is waiting for your domain, or none of the keys it offered are in your file, along with the fingerprints of the keys it tried.
That server does nothing but confirm sign-ins. There is no shell, it runs no commands, and forwarding is turned off. Like any SSH server, it never sees your private key; your SSH client only proves that it has it.
When you sign in, you'll be given a command to run, which signs a challenge with ssh-keygen -Y sign, and you paste the result back in. It needs OpenSSH 8.1 or newer.