You get this exact workflow if you use a passphrase on the -sk key, and add the key to your ssh-agent.
replyEdit: well, maybe not exact. With -sk keys you’d have to type in a passphrase instead of a pin. But that passphrase could be a pin.
Not exactly.
reply1. This method only works (securely) for non-resident keys. 2. hence requiring having pk stub copied manually to every machine 3. its passphrase is prone to brute-force
While piv based ssh keys solve those 3 problems (with one caveat, left for a careful reader :)
Huh, in that case it's possible I did this wrong the last time I tried it, or maybe something's changed.
replyThanks for the tip! I'll try that this evening, I'd love to move to FIDO keys if possible.