<story><title>Nitrokey</title><url>https://www.nitrokey.com/</url></story><parent_chain></parent_chain><comment><author>woodruffw</author><text>I&amp;#x27;m currently using both Nitrokeys and YubiHSMs on a client project. Both work pretty nicely, but some notes:&lt;p&gt;1. Nitrokeys can&amp;#x27;t do Ed25519. If you want to do ECC, you&amp;#x27;re stuck with NSA Suite B (which may be fine, depending on your purposes). This was a bummer for me, though, in the context of a greenfield project. YubiHSMs &lt;i&gt;can&lt;/i&gt; do Ed25519...but they can&amp;#x27;t generate attestation certificates for Ed25519 keypairs. This isn&amp;#x27;t well documented anywhere; I had to lean on a friend who knew a Yubico engineer.&lt;p&gt;2. Nitrokeys can do attestation against a baked in certificate. However, they &lt;i&gt;can&amp;#x27;t&lt;/i&gt; export those attestations via PKCS#11 -- you have to use some custom shell provided by the underlying hardware vendor (CardContact). The baked in cert (and its public roots) are also RSA2048, which is a bit of a bummer. Oh, and everything&amp;#x27;s in a weird container format[1] that isn&amp;#x27;t x509. It&amp;#x27;s still ASN.1 + DER, at least.&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.bsi.bund.de&amp;#x2F;EN&amp;#x2F;Publications&amp;#x2F;TechnicalGuidelines&amp;#x2F;TR03110&amp;#x2F;BSITR03110.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.bsi.bund.de&amp;#x2F;EN&amp;#x2F;Publications&amp;#x2F;TechnicalGuidelines&amp;#x2F;...&lt;/a&gt;</text></comment>
<story><title>Nitrokey</title><url>https://www.nitrokey.com/</url></story><parent_chain></parent_chain><comment><author>jolmg</author><text>As a Yubikey user, what stops me from considering this or the Librem key is the lack of confirmation button &amp;#x2F; touch sensor (and LED).</text></comment>