CodeNSolder GNU Privacy Guard (GPG) or Pretty Good Privacy (PGP) has been the gold standard for asymmetric encryption for decades. Pairing it with a hardware key like a YubiKey makes it significantly stronger: the private key never leaves the device, and every sensitive operation requires a physical touch.
The problem has never been the concept. It has been the tedious and confusing setup.
The friction is the real vulnerability
Doing this correctly involves generating keys on an air-gapped machine, creating encrypted USB backups, printing a paper recovery key, loading subkeys onto hardware, and configuring your daily machine for signing and SSH. Each step is documented somewhere. Nothing ties it all together in a way that is reliable enough to follow without making mistakes.
That friction has consequences. People skip the air-gap step. They skip paper backup. They store the master key on the same machine as the subkeys. They mean to revisit it later and never do. Privacy tooling that is too hard to use correctly is not really protecting anyone.
What YubiGPG does
YubiGPG is a set of 12 ordered bash scripts and config files that walk through the entire key lifecycle:
- Air-gapped key generation on Tails OS
- LUKS2-encrypted USB backups (two copies) and a printed paperkey
- Subkeys loaded onto up to three YubiKeys (daily, home, offsite)
- Daily machine setup for macOS and Linux, covering Git signing and SSH
The scripts are designed so the right path is the easy path. Follow them in order and the end result is a setup done correctly, not just done.
The full guide, including prerequisites, what each script does, and how to verify your setup, is on GitHub: iayanpahwa/YubiGPG.
Why it matters beyond developers
Strong encryption is not a niche concern. Journalists protecting sources, activists in hostile environments, people handling sensitive communications of any kind all benefit from hardware-backed keys. The security model is straightforward: even if your machine is fully compromised, an attacker cannot sign or decrypt without the physical key in hand.
Open-source matters here too. Cryptographic tooling you cannot read and audit is tooling you cannot fully trust. YubiGPG is Apache 2.0 licensed and the community is welcome to review, question, and improve it.
Privacy should be accessible, not just available
The tools to protect your digital identity have existed for a long time. What has been missing is a reliable, accessible path to using them well. YubiGPG is a small contribution toward closing that gap.
If you have been putting off a proper hardware key setup, this is a good place to start.
Give it a try. Download the latest release from GitHub, follow the guide, and see how far you get. If something is unclear, broken, or could be better, get in touch — feedback from real users is how this improves.