It turned out password managers are not as secure as I had expected, but most of the time they are still OK.
- https://karlgrz.com/2fa-gpg-ssh-keys-with-pass-and-yubikey-neo/
- https://news.ycombinator.com/item?id=9727297
- https://news.ycombinator.com/item?id=9727522
