FIDO key enroll without touch

Two Factor Authentication
1

Hello,

is it possible to enroll a fido key without touch ? I would like to use onlykey on a bastion host, with ed25519-sk keys. And have the users generate the keys ssh-keygen -t ed25519-sk -O no-touch-required -f ~/.ssh/users_keyfile. The goal is that the keys are useless without having access to the the host that has the onlykey plugged in. Due to the fact, that the host shall be located in a datacenter where touch is not possible It would be convenient, if I could setup FIDO to enroll keys with no touch required. Is this possible ?

Second Question: Is it possible to remove the pin set with onlykey-cli change-pin

Kind regards,
Manon

2

is it possible to enroll a fido key without touch ?

No, but you should be able to use OnlyKey Agent for this - OnlyKey SSH/GPG agent | Docs

Is it possible to remove the pin set with onlykey-cli change-pin

No, OnlyKey requires a PIN. With OnlyKey DUO a PIN is optional so you can use most features without a PIN.