Is it possible to also add some logic to populate boot entries using https://uapi-group.org/specifications/specs/boot_loader_specification/ ? I have been experimenting with systemd-boot, and it's working fine apart from the missing loader files. Those files look something like this:
/usr/lib/live/mount/persistence/loader/entries/1.4-rolling-202210050218-vty.conf

title     "VyOS 1.4-rolling-202210050218 (KVM console)"
version   1.4-rolling-202210050218
options   boot=live quiet rootdelay=5 noautologin net.ifnames=0 biosdevname=0 vyos-union=/boot/1.4-rolling-202210050218 console=tty0
linux     boot/1.4-rolling-202210050218/vmlinuz
initrd    boot/1.4-rolling-202210050218/initrd.img

There will be similar files for serial and USB console.

To fix some of this issue I modified line 102-103 in show_nat_rules.py:

Curl should only need the private key, since it will extract the public key from it on demand. In any case the private key should probably be password protected and then you'd need some way of prompting for the password and provide it to curl using the --pass parameter.