Hardware tokens are sold as the end of the story: the key never leaves the device, phishing gets harder, you tap and you are done. Sometimes that is true. Sometimes it means the only copy of a secret is a piece of plastic you can drop in a harbour.
I use OpenPGP smartcards (YubiKey and peers) for daily subkeys. I do not generate a certification primary on the card and hope. The card is a use token. The secret is the backup I tested before keytocard.
Basics · A token proves you have the device; a backup lets you continue without it
A smartcard can store a private key so that signing happens on the card. The computer sees a stub (ssb>) and asks you to tap. If the card dies and you have no other copy of that private key, the identity dies with it. A USB stick with an encrypted OpenPGP export is not glamorous. It is how you still exist next year.
Three different jobs on one piece of plastic
A modern YubiKey is several devices:
- FIDO2 / U2F — web authentication, often as a passkey. Convenient. Recovery is whatever the site offers (usually more passkeys, or the mailbox you are trying to harden).
- PIV — smartcard certificates, mostly for the corporate world.
- OpenPGP applet — the one this essay is about: sign, encrypt, authenticate with GnuPG.
Do not assume a FIDO-only token is an OpenPGP backup. Do not assume “I have a YubiKey” means your git signing key lives there. gpg --card-status tells you what the OpenPGP applet actually holds.
gpg --card-status
gpg --list-secret-keys --fingerprintAfter a successful move you want ssb> on the daily machine, not ssb. The angle bracket means “this secret lives on a card.” If you still see a local ssb and you thought you offloaded, you now have two copies, one of them on disk.
Never keytocard the only copy
The OpenPGP applet on many cards will not give the private key back. That is the point. It is also the trap.
Sequence that does not lie:
- Offline primary already exported and restored in
/dev/shm(see Keep the Secret Off the Machine). - Subkeys exist as file secrets (
ssb, not stubs). gpg --edit-key FINGERPRINTthenkeytocardfor sign, encrypt, authenticate as you intend.- Daily machine shows
sec#andssb>. - A second card, or the file backup, can still decrypt a test message and sign a test file.
If step 5 is “I’ll do it later,” you have a single point of failure with a nice USB shape.
Set PINs you can type under stress. Record the Admin PIN somewhere that is not the laptop bag. A blocked OpenPGP applet after three wrong Admin PINs is a brick unless you reset it — and a reset wipes the keys.
What the card cannot do for you
It cannot replace revocation certificates. It cannot replace a printed fingerprint you have published. It cannot sign a new subkey if the certification secret is on the card and the card is gone. It cannot help if you enrolled a passkey at a site that has no other recovery and you lose the only token.
Phishing resistance of FIDO is real and worth using for the accounts that offer it. Enrol two tokens, or a token plus a documented recovery path that is not SMS. SMS is not a second factor; it is another mailbox.
Intermediate · A reasonable non-purist setup
If an offline RSA primary is more ceremony than you will maintain:
- Ed25519 authentication key in the OpenPGP applet, or a dedicated SSH key on the token via
gpg-agent/ssh-add. - A second identical token enrolled everywhere the first one is.
- File backup of any OpenPGP subkeys before
keytocard, on encrypted media. - FIDO2 for the two or three web accounts that actually lock your life (registrar, mailbox, git host).
That is already more sovereignty than a password manager full of TOTP seeds on the same phone that receives the SMS.
The long-beard test
Can you, on a machine that has never seen this card, decrypt yesterday’s test file using only: the encrypted USB, a passphrase in your head, and GnuPG from a Debian live image? If the answer depends on the plastic in your pocket, the token is the secret. That was not the design.
