the key has a border

a secret should have an edge. a hardware key gives a signing request somewhere to stop.

the request is not the key

a host can prepare a message and ask for a signature. that does not require the host to keep the private half in a file, an agent, or a shell variable.

ssh-keygen -t ed25519-sk -f ~/.ssh/id_ed25519_sk

the command names an identity. the hardware key is where the sensitive operation happens. a touch is part of the transaction, not decoration around it.

the boundary has a cost

a security key does not make a live host honest. while the key is connected, a compromised machine can still ask it to sign. the useful difference is narrower: stealing the host later does not automatically collect a portable private key from disk.

that is a good trade. it makes custody physical again. the machine can keep the public half, the request, and the signature. the secret has a different address.

a thing you can lose

a hardware boundary creates a hardware failure mode. the key can be lost, damaged, or left in the wrong drawer. recovery belongs in the plan before the token becomes important.

one key is a boundary. it is not a backup plan.