Use gpg-agent with an yubikey (a hassle to configure), or the ssh-agent from openssh with passkey on yubikey (easy to configure). Require a touch to sign, put

Use gpg-agent with an yubikey (a hassle to configure), or the ssh-agent from openssh with passkey on yubikey (easy to configure). Require a touch to sign, put a password on the key if your paranoid, if you really paranoid disconnect the yubikey when not in use.