[yayana]

I found an X509 oriented device relatively easy for ssh (for gpg it is naturally harder to use these non gpg devices with some kind of bridge daemon).

Assuming Linux or OsX where your distribution has an opensc that already supports your device, ssh is only about 3 incantations of magic:

https://nilsschneider.net/2013/06/20/epass2003-quickstart.ht...

But there is no safe way of getting away from having 1 pin.

[acdha]

On current versions of macOS it’s built in so all you need is to generate the key and add one line to your SSH config:

    PKCS11Provider=/usr/lib/ssh-keychain.dylib

https://support.apple.com/en-us/HT208372