A simple USB keystore to perform basic cryptographical operations for various use cases.
One problem of deploying embedded software in an untrusted environment is that you want your primary device to be disabled once any attempt of break-in is detected. Assuming that the primary device uses dm-crypt for full-disk encryption, you either have to keep the passphrase off-disk via an external storage (weak, does not self destruct), or roll out a millitary grade secure enclave into all of your devices.
How about something cheap and dirty?
Over here we simply store the keyfile in SRAM on the duino. We expose a
References: