I have kept my SSH and signing keys on hardware for years. The private key lives on an OpenPGP card or a Nitrokey, it never touches the disk, and a stolen laptop is a stolen laptop rather than a stolen identity. What changed over the last year is the software I use to talk to those cards. For SSH authentication and Git signing I no longer go through GnuPG at all. I use three small Rust programs from the OpenPGP Card project instead.