trezor-agent

Yes I don't see how that's helpful. It's quite opposite of what I'd want. If you use a trezor hardware wallet (and probably other hardware wallets) you can deterministically regenerate -sk keys. I use trezors various agents for AGE, FIDO2/passkey, ssh[0]. But you still need the backup some bits of material like stubs for some FIDO keys (not secret material) that need importing into fresh trezor devices. It's approaching the never lose a key again levels. Of course, I won't pretend there isn't an obvious issue. What if you lose the seed words or someone gains access. What if the software becomes incompatible, or trezor devices become expensive/change etc. [0] https://github.com/romanz/trezor-agent

Ledger/Trezor have solved this since ~2016. I have a Ledger that has a private key inside and using a small open source tool (https://github.com/romanz/trezor-agent) I can SSH into machines, sign random data and Github commits and FIDO authenticate into several websites. All of that and knowing that these devices offer some of the best security out there.

You can use a trezor and https://github.com/romanz/trezor-agent The cool thing is that the key is derived from the trezor's seed, so you can have several backup devices. And you need pin+passphrase not just the yubikey.

As an awesome alternative you can use a Trezor (or KeepKey) with https://github.com/romanz/trezor-agent for GPG and SSH. Unlike the YubiKey, with the Trezor you have have to enter a scrambled numeric PIN to use it.

Btw you can also do SSH, GPG and 2FA also with Trezor, which has the advantage that for all functionallity you can have a one "24 words" seed backup, from which everything is determined. Oh and you can of course use it as bitcoin wallet :) SSH: https://doc.satoshilabs.com/trezor-apps/sshagent.html GPG: https://github.com/romanz/trezor-agent 2FA: https://doc.satoshilabs.com/trezor-user/u2f.html

I use a Trezor to store my PGP key. I never have access to the private key, it's generated by a seed which I backup in a cryptosteel protected by a password in my brain (to prevent physical theft). The device only provides an interface to sign and decrypt. This keeps the key safe even if your computer is compromised. See: https://github.com/romanz/trezor-agent

I can suggest using TREZOR and Ledger Nano S hardware devices for common GnuPG operations, e.g. signatures and decryption. Please take a look at https://github.com/romanz/trezor-agent/blob/master/README-GP... for more details. Disclosure: I am the main developer of this project.

Great post! BTW, you can also now use hardware devices (like TREZOR and KeepKey) to perform "ssh-agent" functionality in hardware, with minimal setup work. Blog post: https://medium.com/@satoshilabs/trezor-firmware-1-3-4-enable... Source code: https://github.com/romanz/trezor-agent (the README has several demo screencasts).