> Probably filippo should update this software to notice if the only identities presented were from FIDO authenticators and, if so, modify this message to expla

> Probably filippo should update this software to notice if the only identities presented were from FIDO authenticators and, if so, modify this message to explain the reduced risk The you can store non-FIDO keys on a hardware PGP device, use them for SSH authentication via GPG, and configure GPG to always require the same kind of UP checks for access to that subkey on the PGP smartcard. This gives you those same protections but doesn't show up to the server as any special key type. As with the FIDO-based keytypes, you can (mis)configure this so it doesn't require UP checks at all.