You're right — it's not a true "second factor" in the 2FA sense. The idea is to bind password derivation to a physical OpenPGP key. Without the smartcard/Yubi

You're right — it's not a true "second factor" in the 2FA sense. The idea is to bind password derivation to a physical OpenPGP key. Without the smartcard/YubiKey inserted, the program can't generate the same password, even if someone knows the domain/username/phrase. So the key isn't used as extra entropy, but as an essential part of the derivation process.