alt Hacker NewsYubiKeys with proof-of-presence for SSH auth are great, but I still use the YubiKey's OpenPGP slot for this because my preferred behavior is:
1. Require a PIN followed by touch on the first use after inserting the YubiKey
2. For every following authentication while the key remains connected, only require touch
The extra GnuPG setup needed to make this work is unfortunate, but AFAIK this still isn't possible with fido -sk keys on the YubiKey.
You get this exact workflow if you use a passphrase on the -sk key, and add the key to your ssh-agent.
Edit: well, maybe not exact. With -sk keys you’d have to type in a passphrase instead of a pin. But that passphrase could be a pin.