Yeah, for the paranoid you’d have an air-gapped box with your PGP tools on it that you’d plug the hardware key into for setup.