YubiKey中ED25519-SK SSH密钥无法连接GitHub问题求助

我在本地和YubiKey上分别生成了ED25519类型SSH密钥，YubiKey上的是安全密钥类型的ED25519-SK。本地密钥执行ssh -t git@github.com能成功连接GitHub，但用YubiKey的SK密钥连接时提示权限拒绝。已确认两个密钥都正确添加到GitHub账户和ssh-agent中，附上调试日志：

$ ssh -tv git@github.com
OpenSSH_9.0p1, OpenSSL 1.1.1q  5 Jul 2022
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to github.com [140.82.113.3] port 22.
debug1: Connection established.
debug1: identity file /c/Users/USER/.ssh/id_rsa type -1
debug1: identity file /c/Users/USER/.ssh/id_rsa-cert type -1
debug1: identity file /c/Users/USER/.ssh/id_ecdsa type -1
debug1: identity file /c/Users/USER/.ssh/id_ecdsa-cert type -1
debug1: identity file /c/Users/USER/.ssh/id_ecdsa_sk type -1
debug1: identity file /c/Users/USER/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /c/Users/USER/.ssh/id_ed25519 type -1
debug1: identity file /c/Users/USER/.ssh/id_ed25519-cert type -1
debug1: identity file /c/Users/USER/.ssh/id_ed25519_sk type -1
debug1: identity file /c/Users/USER/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /c/Users/USER/.ssh/id_xmss type -1
debug1: identity file /c/Users/USER/.ssh/id_xmss-cert type -1
debug1: identity file /c/Users/USER/.ssh/id_dsa type -1
debug1: identity file /c/Users/USER/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.0
debug1: Remote protocol version 2.0, remote software version babeld-adca5b9e
debug1: compat_banner: no match: babeld-adca5b9e
debug1: Authenticating to github.com:22 as 'git'
debug1: load_hostkeys: fopen /c/Users/USER/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU
debug1: load_hostkeys: fopen /c/Users/USER/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'github.com' is known and matches the ED25519 host key.
debug1: Found key in /c/Users/USER/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: agent returned 1 keys
debug1: Will attempt key:  ED25519-SK ********************************** authenticator agent
debug1: Will attempt key: /c/Users/USER/.ssh/id_rsa
debug1: Will attempt key: /c/Users/USER/.ssh/id_ecdsa
debug1: Will attempt key: /c/Users/USER/.ssh/id_ecdsa_sk
debug1: Will attempt key: /c/Users/USER/.ssh/id_ed25519
debug1: Will attempt key: /c/Users/USER/.ssh/id_ed25519_sk
debug1: Will attempt key: /c/Users/USER/.ssh/id_xmss
debug1: Will attempt key: /c/Users/USER/.ssh/id_dsa
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key:  ED25519-SK ********************************** authenticator agent
debug1: Server accepts key:  ED25519-SK ********************************** authenticator agent
sign_and_send_pubkey: signing failed for ED25519-SK "" from agent: agent refused operation
debug1: Trying private key: /c/Users/USER/.ssh/id_rsa
debug1: Trying private key: /c/Users/USER/.ssh/id_ecdsa
debug1: Trying private key: /c/Users/USER/.ssh/id_ecdsa_sk
debug1: Trying private key: /c/Users/USER/.ssh/id_ed25519
debug1: Trying private key: /c/Users/USER/.ssh/id_ed25519_sk
debug1: Trying private key: /c/Users/USER/.ssh/id_xmss
debug1: Trying private key: /c/Users/USER/.ssh/id_dsa
debug1: No more authentication methods to try.
git@github.com: Permission denied (publickey).

从日志里的sign_and_send_pubkey: signing failed for ED25519-SK "" from agent: agent refused operation可以看出，ssh-agent无法调用YubiKey完成签名操作，按以下步骤排查：

• 确认YubiKey状态：确保YubiKey已插好，若设置了PIN需先解锁；部分YubiKey需要触摸感应区才能完成签名，连接时记得触摸密钥。
• 重置ssh-agent并重新添加密钥：
  1. 停止当前ssh-agent：ssh-agent -k
  2. 重新启动并加载环境变量：eval $(ssh-agent)
  3. 重新添加YubiKey密钥：ssh-add ~/.ssh/id_ed25519_sk（替换成你的实际密钥文件名）
• 验证GitHub公钥一致性：
  1. 导出本地公钥：ssh-keygen -y -f ~/.ssh/id_ed25519_sk
  2. 对比输出内容与GitHub账户中添加的公钥是否完全一致，注意不要遗漏开头的sk-ssh-ed25519@openssh.com标识。
• 更新YubiKey固件：你使用的OpenSSH 9.0支持SK密钥，但旧版YubiKey固件可能存在兼容性问题，用官方工具更新固件到最新版本。
• 强制指定密钥测试：绕开ssh-agent直接用指定密钥连接，观察是否触发YubiKey签名提示：ssh -tv -i ~/.ssh/id_ed25519_sk git@github.com

内容的提问来源于stack exchange，提问作者Austin