bockafer

  - The pins for PIV and OpenPGP are separate as these are separate modules on the card.
  - You can't use the PIV or NEO GUI managers and gpg at the same time. You might have to unplug and plug the token
    back in when switching back and forth between GUI/cmdline Yubico tools and gpg.
  - Forgetting to change my environment to use gpg-agent instead of ssh-agent.
  - Typing in my local password instead of the PIV pin when logging into OSX while I have a token with PIV enabled
    plugged in.

  - Configure gpg.conf.
  - Generate master, subkey, and revocation material on an encrypted USB drive for offline backup of materia
    along with revocation certificates.
  - Backup original .gnupg directory to another folder on the encrypted USB drive. 
  - Copy .gnupg directory to second encrypted USB drive for offsite backup.
  - For each smart card I wanted the same material on:
  -- Change default user and admin pins.
  -- keytocard subkeys for (S)ign, (E)ncrypt, (A)uthenticate (without saving keyring).
  -- Require local touch for all material ( Yubico specific: https://developers.yubico.com/PGP/Card_edit.html ).
  -- move on to next card.
  -- save keyring after running keytocard on the last card so the subkey material no longer exists in the local keyring, only
     references to it (this might not be necessary, I need to test).
  - Generate a copy of the keyring without master key to use on daily machine(s). Might also only need to have the master 
    material minus the key in the keyring as noted above. I haven't tested how 
  - Copy new keyring to another USB drive for transferring to daily machine(s).
  - Configure gpg-agent.conf and gpg.conf on daily machine.