Ooh yeah I definitely don't want this either. I want GPG to ask for the pincode once, and the yubikey to require a physical touch for each authentication (incl

Ooh yeah I definitely don't want this either. I want GPG to ask for the pincode once, and the yubikey to require a physical touch for each authentication (including the first, obviously). This way it can't be automated by malware either (a pincode can be sniffed and replayed through the keyboard driver, the physical touch can't). The PIN is great against attackers that find your key on the street. Not against a determined attacker that is already on your computer. For that the physical touch thing is a great solution (though the yubikey doesn't require it by default, you can easily turn it on). Asking the pin upon first use and a touch every time is the perfect compromise between security and usability IMO. There's still some weakness around attackers with physical access but they are more easily mitigated.