[ejholmes]

If you have a recent MacBook, use https://github.com/ntrippar/sekey for SSH keys. Private key is stored in the built-in HSM (Secure Enclave) and access is controlled by biometrics (TouchID). You can do the same with a Yubikey, but it’s not quite as good because a) you can lose your Yubikey easily and b) there’s no biometrics.

Private keys stored on filesystems is an antipattern.

[Whitestrake]

Ahh, if only Apple released a non-touchbar MBP with Touch ID! I'd have used this in a heartbeat.