[closeparen]

I tried to do something like this last summer. I found little to zero intersection between the cards that GlobalPlatformPro can personalize, and the cards that you can just buy in low volume at reasonable cost.

I think I did buy one "$5" JavaCard but the shipping was like $50.

As much as I admire GlobalPlatformPro, staking your small company's security infrastructure on 1) a hobby project maintained by one guy (Martin Paljaik), and 2) materials with "call us" pricing that the suppliers really don't want to sell in sub-thousands volume seems worse than just using Yubikey.

Oh, also, I couldn't find an actual working open source PKCS#11 applet that wasn't abandonware. I did get something working with GPG (though it felt like duct tape and prayer), but I couldn't get the PKI stuff to work at all.

[mjg59]

I've used http://www.smartcardfocus.us/shop/ilp/se~any/so~5/p/index.sh... without any trouble - the Yubico GPG applet runs on them happily, and we're using https://github.com/philipWendland/IsoApplet for PKCS#11 based signing.

[pisipisipisi]

this "one guy" here. I would say that the availability of open access cards is almost excellent these days, at least in EU. The quality of those easily available cards (chinese) is questionable though. But there are cards available from other vendors as well (most notably NXP)

[closeparen]

Haha I love HN.

EU might be the differentiator. I do remember seeing a lot of cards that would only ship to EU, or shipping to US was prohibitively expensive.

Keep up the awesome work.

[pisipisipisi]

HN is nice indeed, but the awesome work would be more effective with less HN ;)

I have been thinking for a long time about opening a webshop for "pre-verified cards" that would come with an open source SDK and as much docs as possible. Maybe that would help (but would still only ship to "western world").