How-tos

End-to-end guides for the things people actually do with the device. Every command here runs against real hardware.

• SSH keys — FIDO2 resident keys for OpenSSH: the private key never leaves the device.
• Linux local authentication — require the device at login with PAM.
• Unlocking disk encryption — LUKS volumes whose secret is derived on the board.
• Signing git commits — signatures from a key that was born on the chip.
• Encrypting to the recipient — mail and files sealed for one reader, with the card.
• The seed backup — the one-shot 24-word phrase that carries the vendor seed off the board; your passkeys are not in it.
• Changing the USB identity — swap the VID:PID from PicoForge or the CLI, without stranding the CCID reader.
• Signed secure boot — sign the firmware and burn the fuse, with every irreversible step named first.
• Nostr identities — hold and sign with BIP-340 Nostr keys through the browser extension: connect, generate or import, sign events, NIP-44 encryption.

More guides land as they are validated on hardware.