Not exactly.

1. This method only works (securely) for non-resident keys. 2. hence requiring having pk stub copied manually to every machine 3. its passphrase is prone to brute-force

While piv based ssh keys solve those 3 problems (with one caveat, left for a careful reader :)

Huh, in that case it's possible I did this wrong the last time I tried it, or maybe something's changed.

Thanks for the tip! I'll try that this evening, I'd love to move to FIDO keys if possible.