Ephemeral tokens are a valid approach and some systems use exactly that.
The difference with Shamir is what happens if the proxy itself is
compromised. With token exchange the proxy holds or can reconstruct
the real key server side. A compromised proxy is game over for the
credential.
Comments
Why use a Shamir architecture at all, instead of giving the CI run an ephemeral token that will be exchanged on the proxy?
Ephemeral tokens are a valid approach and some systems use exactly that.
The difference with Shamir is what happens if the proxy itself is compromised. With token exchange the proxy holds or can reconstruct the real key server side. A compromised proxy is game over for the credential.