f333f4e99d
It turns out that when using PIV rather than OpenPGP for SSH (`yubikey-agent` in this case), you cannot change the touch policy for enrolled keys[1]. However, it turns out that the default (`always` - touching the key for each SSH auth) is pretty annoying when running remote builds or making SSH signatures, so I had no choice but to rotate the keys once again. It's not urgent at all to get this key deployed, I'm only filing this patch now to check every box on my "SSH rotation checklist" so I don't forget about it. Happy holidays 🎉 Finally, sorry for the additional noise! [1] https://docs.yubico.com/yesdk/users-manual/application-piv/pin-touch-policies.html#touch-policies |
||
|---|---|---|
| .. | ||
| keys | ||
| default.nix | ||
| packages.nix | ||
| users.nix | ||