QFT: “it’s no secret that I hate PGP, and I think you should just never use it to communicate, but alas it’s the only ecosystem that easily taps into cheap hardware tokens, which are a concrete step up in security, and at least you can rotate them” — @filippo

https://words.filippo.io/touch-to-operate-password-store-yubikey-4/

OpenSSH 8.2+ have easier support for SSH keys derived from FIDO-2 tokens but Git code signing is far too complicated to expect people to use it pervasively.