"this app needs me to generate a key and point to it in config" is plenty of overlap
If you just want a raw ed25519 private key then `head -c32 /dev/urandom` does the job. But usually you want a DER/PEM wrapper or similar, which the openssl cli tools handle nicely.
I don't consider myself a programmer and I can use Ed25519 safely. I do however understand computing fairly well.
I consider myself a programmer and ed25519-understander, but the idea of using it directly within a shell script terrifies me.
Simply combine this tool with `openssl enc` and your shell script is as secure as any shell script could be