This is awesome, I can now have hardware backed SSH keys without any PKCS#11 or gpg-agent in the mix. A blue security key is enough.