--pin-source stdin prevents PIN visibility in `ps` output. Use tempfile.mkstemp for all temp files (unpredictable names, 0600 perms). Clean up temp files in finally block. Add tests for PIN not in args and mkstemp usage.
Description
Self-contained certificate authority with YubiKey-backed signing. Root + intermediate CA keys on two YubiKeys; every signing requires physical touch + PIN.
Languages
Python
47.1%
HTML
27.3%
Shell
25.6%