Thank you very much for your answers and thoughts about my many questions! I hope you will go on to write more about the subject. Most of my questions relate in

Thank you very much for your answers and thoughts about my many questions! I hope you will go on to write more about the subject. Most of my questions relate in some way to my last time setting up a new network about 2 years ago. At the time I found that each question relating to certs seemed to lead me to two more questions or some ambiguity and I kind of forgot how all the problems ended up somewhat interlinked and related to this non-x509 cert format and/or selecting x509 or gpg models of token use. It looks like there is some support in both keygen and ssh-agent at least for combining a cert file with a pkcs11 key and maybe I can work out how to get custom format in and out of pkcs15 storage. The situation with gpg card applet and gpg-agent ssh support looks like it may be similar.. My general view is that a smartcard with a non-extractable key, corresponding x509 cert, and pin manages the minimal something you have, know, and identity in the only way that everyone at least intended to support at some point. I.e. ssh actually works well with it using the raw public key, as client certs pkcs11 should work with the browsers, some of the vpn implementations have pkcs11 support.. I think even kerberos should be able to bootstrap identity from it with pk-init. All the other applets combined into commercial keys for MFA are all very interesting but tend to each be piecemeal in protocols they could be used for.