Store longer keys on Yubikeys

[renatav]

There should no longer be a limitation of 2048 bits.

[n-dusan]

• Remove the command for setting up yubikey;
  • Point to Yubico official tooling instead

[renatav]

After diving deeper into this, here is what I discovered:

• As previously mentioned, PIV has a limitation of 2048 bits. Our current YubiKeys utilize a PIV slot.
• The YubiKeys we use are compatible with OpenPGP. For detailed information on setting up the keys, see the official docs.
• I managed to generate 4096-bit keys on my Windows machine, but this required setting key-attr as described in the official documentation.

However, even though I succeeded in generating these longer keys, our code still utilizes the PIV slot. I discovered this when implementing a command to export key-description data (which calculates key size based on the public key's length). This means that to start signing with longer keys, we'll need to completely rework our YubiKey code. Another issue is that the Python library's support is more limited compared to what the ykman CLI and other tools like GnuPG offer. Therefore, we can't easily replace the signing code that relies on PIV.

We could invoke the ykman CLI using a subprocess, but that would require users to install additional tools on their machines and will certainly be slower.

I am going to add the BIG DEAL label and move this to the backlog for now. We should conduct further research and have a discussion.

[renatav]

Another possible solution is to use a different signing scheme. This might require some refactoring, but should be doable. Something like ECC P-384 seems to be supported by piv and is more secure than RSA 2048