A Linux systems administrator is setting up SSH access with PKI for several using their newly created RSA keys. Which of the following MOST securely achieves this task?

curl is an HTTP/FTP transfer tool and has no mechanism to authenticate and place SSH public keys into the correct authorized_keys file on a remote system.

cp is limited to local filesystem operations and cannot transfer files to remote hosts or modify the remote authorized_keys file.

ssh-copy-id authenticates to the remote host using the existing credentials and appends only the user's public key to ~/.ssh/authorized_keys with correct file permissions enforced automatically. It is purpose-built for this task, prevents duplicate key entries, and avoids the manual permission errors that could silently break key-based authentication.

Copying a private key to a remote system is a critical security violation; private keys must never leave the owner's machine, as their exposure allows full identity impersonation.