you can’t just pop it out once you’re logged in?

Sure and pop in whenever I do a git commit? I also sign my commits. I used GPG (different key on the same hardware key) and now via SSH key. I had both a compact and bigger key. I got the compact key because my very first yubikey nearly broke. I lifted my Mac while it was connected and it cracked in the middle. I bought a compact one next which can stay inside and that one you don’t want to take out. It’s so small you’ll lose it. I know because that happened to my backup key … (that was actually the idea for the bigger one I bought but I lost the damn thing during the setup phase) But having the yubikey bound to your Mac at all times is also stupid because it doesn’t come with a fingerprint or other biometric sensor. The idea is that you use this thing as a token not that you leave the key in the lock at all times. For that alone I would favor the enclave solution.

The Yubikey 5 Nano and 5C Nano DO come with touch.

The idea is precisely that you keep them permanently connected in the laptop.

Touch is not the same as biometrics. I think they’re saying that leaving it plugged in means that anyone that can unlock your computer can also use/touch your yubikey.

The way I think of it is YubiKeys should be used to basically provision a computer with an approved device specific key. Whether it's a passkey or SE/TPM secured SSH/GPG/TLS key: the Yubikey holds the credential everyone trusts and therefore can be used from any device to gain access and enroll a new approved key.

Why do you share private keys?

SSH private keys should be passphrase protected.

You don’t have to do that if you use FIDO2 with a Yubikey.

Share as in storing my key in 1Password and use it from different machines. I generated the key from 1Password and don’t intend to export it.

You should reevaluate if you can instead use multiple public keys where you need to connect.

It’s a mind shift worth considering.

You then can accept that your ssh keys are different per hardware token (because the private key cannot be extracted).

No more sharing of private keys in your password manager.

I’m a bit lost and maybe something also got lost in translation. I use 1Password to store multiple ssh keys for different services. I have a very restrictive ssh config because I don’t like to use ssh agent which hands out all keys to different connections. I use one key for a set of machines for work. One for GitHub etc etc etc. I connect to these machines from different endpoints. And I don’t want to register each of these with a new custom keypair to all the services. Like GitHub. I have 1Password installed on all desktops I use so I pull them from there. I share the same dot files and configuration. For GitHub I actually need 3 keys. My private key, 2 for work that have special SSO permissions. I don’t want my private key to have access to the work repos that’s why I split and my company has 2 different enterprise accounts where I have 2 different user accounts.

You can use CA signed -sk keys to avoid the provisioning hassle. Provision the CA public key only onto hosts. Disclosure: Claude taught me this trick.