I've recently started to track my service dependency graph! So like, to keep using github I need my password store, my email and one of my two security keys. To use my email, I need...

Please contact me if you're interested, I will release the tooling I have.

It would indeed be nice if you could "cross sign", CA style, a new yubikey with an old one, and that would somehow get passed along to the various services.

I have not thought about the various attack vectors that this may or may not enable though.

FIDO2 with resident SSH ed25519 keys works great, just make sure the OpenSSH client and server versions on all the machines you’ll be using the key on support it. I wish there was a way to sign Git commits somehow using them instead of PGP.

There is as of Git 2.34 [0][1].

[0] https://github.blog/2021-11-15-highlights-from-git-2-34/#tid... [1] https://git-scm.com/docs/git-config#Documentation/git-config...

Oh nice! No more futzing around with GPG. You just made my day.

You can backup/restore FIDO2 keys via BIP39 on supported devices like a Ledger or Trezor.