What It Is Not

No PIV/PKCS#11, no NFC, no YubiKey-style HMAC challenge-response (so no native LUKS/KeePassXC unlock). For maximum off-the-shelf auth coverage a YubiKey 5 wins; the Nano X’s distinctive edge is the display (approvals you can read) plus seed-recoverable derived keys.

Proposed Sequence (when promoted)

1. Enroll Security Key app in Authentik, then Forgejo (no infra changes).
2. Move MJF SSH/Git identity to the OpenPGP app; grant the new public key through the standard flow; keep existing keys until verified.
3. Run the age/hmac-secret test; if it passes, add the Ledger recipient to the garden additively.
4. Scope the custom approval-oracle app only if 1–3 prove the workflow.