I just have my SSH keys on a yubikey: They're generated on token and the private key can't be exported. This makes them unique and unstealable. They can still

I just have my SSH keys on a yubikey: They're generated on token and the private key can't be exported. This makes them unique and unstealable. They can still be abused "live" while they are inserted via an SSH agent, but I turned on the "touch to sign" feature so for every use you have to touch the token button as well.