Review the Ed25519 model
The documentation explains key-pair generation and request signing. The private key is intended to remain in the client environment.
# Generate key pair
openssl genpkey -algorithm ed25519 \
-out private_key.pem
openssl pkey -in private_key.pem \
-pubout -out public_key.pem