An SSH private key on a laptop is a file. It is in the home directory, in the backup, and in the disk image, and it usually opens production. Passphrases help against a casual finder and not at all against anything running as you.
OpenSSH already speaks PKCS#11
This needs no wrapper and no agent of ours. OpenSSH reads keys from a PKCS#11 provider directly:
ssh -I /usr/lib/opensc-pkcs11.so user@host
or permanently, in ~/.ssh/config, with PKCS11Provider /usr/lib/opensc-pkcs11.so. ssh-add -s loads it into the agent for the session, and ssh-keygen -D prints the public key in the format authorized_keys wants. On Windows the same provider path points at the OpenSC DLL.
The private operation happens on the card, so the key is never in the process, never in swap, and never in a core dump. Unplug the device and the laptop can no longer authenticate.
Machine identity, not just human logins
The same key can be the identity of a machine rather than a person: a jump host that proves what it is, a backup agent that authenticates to a vault, a build runner that signs its own artefacts. Because the key is non-extractable, cloning the machine does not clone its identity, which is the difference between an inventory and an actual identity.
If you run an SSH certificate authority, the CA key is the obvious thing to move into hardware first: it signs every host and user certificate you trust, and it is used rarely enough that the per-signature cost is irrelevant. See running your own CA.
Practical notes
Use an EC P-256 or P-384 key. It is fast, every current OpenSSH supports it, and you avoid the multi-second signature an RSA-4096 key would cost you on each connection. The card will generate RSA to 4096 and EC to P-521 if you need them for something else.
Keep a second authentication path. A hardware key that has to be present is exactly as available as the device, so have a break-glass route into anything you cannot afford to be locked out of, and test it.
Where to go next
SSH is the fastest of these to try: no server-side change is needed. See also TLS server keys, running your own CA, or the hardware security module overview and the datasheet.
The KeyNub HSM ships from Munich. Ask us if you want to talk through a deployment first, or order one.
