Hardware-backed SSH keys, end to end: YubiKey, PIV, software alternatives, and where SSH CAs fit in

This is a working guide to using a YubiKey for SSH on a real Linux fleet, plus the surrounding landscape — PIV, software-only alternatives, and SSH certificate authorities. The goal is to retire file-based SSH keys without breaking daily operations. The article is structured around four questions: What does a hardware-backed key actually do, and what knobs do you control? How do you combine those knobs into a policy that works for both root login and Ansible? What if you can't ship YubiKeys? Whe