Option 3 — AGE Garden Unlock (test required)

The garden is age-encrypted. age-plugin-fido2-hmac derives an age identity from any FIDO2 token implementing the CTAP2 hmac-secret extension (mandatory in CTAP 2.1). If Ledger’s Security Key app exposes it, the Nano X becomes a physical unseal key: decrypting any .env.age requires device + tap.

• Test: ~10 minutes against a scratch age file before any garden re-keying.
• If unsupported: this single gap is YubiKey territory; the rest of the seed stands.
• If supported: add the Ledger-derived recipient alongside existing garden recipients first (additive, no lock-out risk), per maintenance policy.