Thanks, the post is good! But I have to admit that there is probably no way to do that properly. If Wireguard key is in Yubikey, every packet has to go to Yubi

Thanks, the post is good! But I have to admit that there is probably no way to do that properly. If Wireguard key is in Yubikey, every packet has to go to Yubikey for encryption and decryption. That doesn’t work! The usual recommendation is to encrypt the Wireguard key with pass or gpg. But an attacker that can access a Wireguard key in /etc/Wireguard must have root access. Such attacker would have access to stdout put by Gpg and could read the key. It could also dump the memory and read the key from there.