I deleted all my SSH keys

The piece explains a move away from ordinary SSH private keys stored on disk toward credentials protected by hardware. The author notes that passphrase-protected keys are adequate for many threat models: OpenSSH can keep decrypted material in memory through an agent, so a stolen key file is not immediately usable. The motivation is instead to eliminate exposed key material and explore hardware-backed options with minimal extra software, including practical use in unattended services and containers.

Three approaches are compared. YubiKeys can hold resident ed25519-sk keys directly; their on-disk “private key” file is only a handle, and normal use requires a physical touch. A no-touch option enables unattended access but allows anyone with access to the plugged-in device to use the key without interaction. TPM-backed keys use the ssh-tpm-agent package and can authenticate through an agent socket, including for services such as systemd mounts. Their key files do contain encrypted private material, however, and the TPM does not bind access to boot-state measurements; PIN-free use therefore requires care. On macOS Sequoia, the Secure Enclave can create non-exportable keys requiring Touch ID, with OpenSSH using exported handle files and Apple’s provider library. The author notes limitations in selecting individual handles and that Touch ID is unavailable in closed-lid clamshell mode. Overall, the methods trade convenience, setup complexity, and unattended operation against stronger hardware protection.