If you have a recent MacBook, use https://github.com/ntrippar/sekey https://github.com/ntrippar/sekey for SSH keys. Private key is stored in the built-in HSM (S

If you have a recent MacBook, use https://github.com/ntrippar/sekey https://github.com/ntrippar/sekey for SSH keys. Private key is stored in the built-in HSM (Secure Enclave) and access is controlled by biometrics (TouchID). You can do the same with a Yubikey, but it’s not quite as good because a) you can lose your Yubikey easily and b) there’s no biometrics. Private keys stored on filesystems is an antipattern.