Yep, that’s what I described and any CA accepted by the client can do it

They don’t have your private key

What risk are you trying to mitigate, specifically?

If it’s the CA taking over your site, control over your CA specifically doesn’t really give any advantage to an attacker (they would have to hijack traffic and provide a new certificate - nobody will notice if the certificate is from a different CA).

Note that your CA cannot decrypt the exchanges between your server and its clients.

FILENAME='birthday_0' $(cat command_ffmpeg_SYNCAUD)  

cat prints out a file without altering it’s contents.

If it’s important to keep the commands in a separate file, you could use sed to find/replace, or use eval, or use some external template engine (lookup “bash expand variables in file”).

What you probably want to do instead, I assume, is to replace the external files with regular bash variables:

filename="some-file"
command="ffmpg -i ${filename}.mpg -bla -blabla ${filename}.mkv"
echo "$command"

It’s great to see more and more project leaving github!

PS: “Live Demo” on https://www.pdfding.com/ is a dead link