My SSH private key lived on four computers and in every backup, and my qualified SIGEN-CA certificate was a .p12 file in my Downloads folder. Nothing was ever stolen, but when I asked myself how many private keys would walk out of the building with my laptop, I had no answer. So I gave myself a single rule: no private key I care about may exist on a disk of mine. This is the story of keeping that rule and moving everything onto two YubiKeys — server logins, my national e-ID certificate, passkeys, and the six-digit codes the key now generates itself. I show what worked, where it broke, and how a few wrong PIN entries locked me out of my own keys, because that is the real danger of these devices: not theft, but locking yourself out. Which is why I also talk about the backup key, about testing recovery, and about what this migration does not solve.