I found an X509 oriented device relatively easy for ssh (for gpg it is naturally harder to use these non gpg devices with some kind of bridge daemon).

Assuming Linux or OsX where your distribution has an opensc that already supports your device, ssh is only about 3 incantations of magic:

https://nilsschneider.net/2013/06/20/epass2003-quickstart.ht...

But there is no safe way of getting away from having 1 pin.