> The truly paranoid will keep their private keys on an encrypted thumbdrive and remove it from the machine after authenticating the key into their keychain Wh

> The truly paranoid will keep their private keys on an encrypted thumbdrive and remove it from the machine after authenticating the key into their keychain While the more secure organisations disable USB in the OS / BIOS and glue the ports shut to prevent anyone using them, to prevent against data loss by employee. Source: worked in two different organisations that literally glued the USB ports shut.