Hardware-backed SSH keys, end to end: YubiKey, PIV, software alternatives, and where SSH CAs fit in

This is a working guide to using a YubiKey for SSH on a real Linux fleet, plus the surrounding landscape — PIV, software-only alternatives, and SSH certificate authorities. The goal is to retire file-based SSH keys without breaking daily operations. The article is structured around four questions: W