Option 2 — OpenPGP app (SSH + signing identity)

Makes the Nano X an OpenPGP smartcard driven by GnuPG (one key slot; XL variant has three: sign / encrypt / auth).

• SSH auth via gpg-agent: the “MJF identity” key for pi4, VPS, and Forgejo git lives in the secure element — unexportable, tap-to-use (UIF mode per operation).
• Fits the house per-device key model as the strongest device class: the public key is granted through the normal authorized_keys / Forgejo flow; nothing about the grant contract changes.
• Commit/tag signing on Forgejo for provenance.
• Caveats: requires pcscd on the host; setup is fiddly; Ledger’s dedicated SSH-agent app is deprecated in favor of this route; verify ed25519 behavior on current firmware (historical signature issues), nistp256 path is the proven one.