Using a sc like yubikey is great for security, but has performance implications for parallel tasks like salt-ssh across a bunch of hosts. Yubikey can only handle a single thing at a time, and is a touch slow, so if you are using salt-ssh to run a command on multiple servers, and if that salt-ssh happens to use GPG to decrypt pillars, then you're going to be waiting hundreds of times longer than you would using the vanilla, parallelizable ssh agent and scdaemon-free gpg-agent.