On: Security keys are now supported for SSH Git operations

[loulouxiv]

And adding -O resident to the ssh-keygen command. However it is only supported on FIDO2 keys (which are spec'd to ask a PIN when using a resident key)

[microtonal → loulouxiv]

Not just FIDO2, I think you also need CTAP 2.1 for credential management/protection. E.g. my pre 5.2.3 firmware (which adds credential management) YubiKey Nano fails with:

    debug1: ssh_sk_enroll: /dev/hidraw0 does not support credprot, refusing to create unprotected resident/verify-required key

[stavros → microtonal]

Yes, your USB key needs to have resident key support. I'm looking forward to the Solo key (which is now one or two years delayed from when it was originally supposed to come out), which will apparently support thousands of resident keys.

You don't need so many for SSH, but it's great for usernameless/passwordless auth with websites.