OpenPGP signing via YubiHSM
As part of https://gitlab.com/freexian/organization/okr/-/issues/10, we need to make it possible to secure all of Debusine's OpenPGP keys using a hardware token. We already support using a YubiHSM for OpenSSL-based signing methods, but not yet for OpenPGP.
Unlike with YubiKeys, this isn't very well documented. There are at least some existing approaches around, with varying levels of support: