Yubikey
A USB security device that can act as a GPG smartcard.
GPG and SSH Keys
I keep my private GPG and SSH keys on a Yubikey. Using them takes a few dependencies, and the machine needs a restart afterward before it will see the key.
sudo apt install gnupg scdaemon pcscd yubikey-manager
sudo systemctl enable --now pcscd
sudo reboot
Once it’s back, import the public key and tell GPG’s agent to serve SSH as well:
wget -qO- "https://jeremyboles.com/public.pgp" | gpg --import -
echo "disable-ccid" >> $HOME/.gnupg/scdaemon.conf
echo "enable-ssh-support" >> $HOME/.gnupg/gpg-agent.conf
export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
gpgconf --kill gpg-agent
gpg-connect-agent updatestartuptty /bye
The Debian page has the version of this that runs as part of setting up a new machine, along with the .bashrc lines that make it stick.