[markstos]

Unless I've missed something, SSH keys stored on Yubikeys are still hampered because you aren't allowed to a touch policy of "touch never".

Imagine needing to touch the Yubikey with each "git pull" or using Ansible to operate over SSH on a dozen servers in parallel, and needing to touch the Yubikey once for each server.

The feature request I'm tracking is here: https://github.com/FiloSottile/yubikey-agent/issues/95

The proposed feature would allow setting a touch policy for the SSH key.

[xena]

If you use SSH ControlMaster sockets, it's not so bad in practice. It can be a pain at times, but I think the security is worth it.