There are a few mentions of "platform authenticators", but do we even have such a thing on Linux? There isn't even a standard X.509 certificate/key store, unless you count GPG which has little application support. Firefox and Chrome use separate UNENCRYPTED NSS stores, LibreOffice and some others just hijacks the Firefox store, KDE apps use GPG through Kleopatra, some apps keep p12 files...
What we desperately need is a simple protocol with a set of basic functions like sign, encrypt and verify that every program uses (like Microsoft's CryptoAPI), then let the user pick a provider depending on their needs. You could have one provider that stores a dir of unencrypted key files if you really don't care, have the files encrypted and request a password on each use, one that talks to a smartcard, maybe a one that uses a connected smartphone with a secure element to do the crypto...
This project is the first that I've seen doing something like that, but it seems to only focus on FIDO/webauthn/whatever. Hopefully it can be eventually generalized to other cryptography uses too (HTTP client certs, S/MIME, PDF signing, encrypted disks/folders...).
What we desperately need is a simple protocol with a set of basic functions like sign, encrypt and verify that every program uses (like Microsoft's CryptoAPI), then let the user pick a provider depending on their needs. You could have one provider that stores a dir of unencrypted key files if you really don't care, have the files encrypted and request a password on each use, one that talks to a smartcard, maybe a one that uses a connected smartphone with a secure element to do the crypto...
This project is the first that I've seen doing something like that, but it seems to only focus on FIDO/webauthn/whatever. Hopefully it can be eventually generalized to other cryptography uses too (HTTP client certs, S/MIME, PDF signing, encrypted disks/folders...).