When I read installation guide for a couple times I was sure I need to

generate 3 keys and those envs should contain private keys:
  - CONCOURSE_TSA_HOST_KEY
  - CONCOURSE_TSA_AUTHORIZED_KEYS
  - CONCOURSE_TSA_WORKER_PRIVATE_KEY

end up reading golang code, running GO SSH with similar configuration
and ended with understanding that ssh keys does not match.

Ideally, I would suggest to rename those envs but I believe it will
might be a breaking changes for old users. So at least, I hope, this
will help to improve documentation

keywords for google:
 - concourse ci PTY allocation request failed on channel 0
 - concourse ci shell request failed on channel 0
 - concourse ci tsa.connection.handshake-failed

lit/docs/install/web.lit

@@ -40,7 +40,7 @@ as performing all pipeline scheduling. It's basically the brain of Concourse.
   \codeblock{bash}{{{
   CONCOURSE_SESSION_SIGNING_KEY=path/to/session_signing_key
   CONCOURSE_TSA_HOST_KEY=path/to/tsa_host_key
-  CONCOURSE_TSA_AUTHORIZED_KEYS=path/to/authorized_worker_keys
+  CONCOURSE_TSA_AUTHORIZED_KEYS=path/to/authorized_worker_keys.pub
   }}}
 
   Finally, \code{web} needs to know how to reach your Postgres database. This