My recommendation anymore is keepassxc for movable ssh keys. It can put them into the agent and remove them automatically when screen locks or other events hap

My recommendation anymore is keepassxc for movable ssh keys. It can put them into the agent and remove them automatically when screen locks or other events happen. Combined with a yubikey for 2fa on the database the security is pretty decent. A flash drive with a portable copy of keepassxc should work nicely.