Depending on the cards and their configuration, you could generate the key outside (say, on a trusted machine at home) and upload it to the card. If the cards gets stolen, and you trust the security of the card to not leak the key, you could just get yourself a new one and upload the old key again.
The other philosophy is to generate the key on the RSA card, and never allow the card to export it. Then you consider the private key dispensable and will have to update all systems to accept a new card's private key.
I don't see a situation where you are unable to get console access as an acceptable situation. You don't need to be using a smart card to require local console access if things go bad. What about if the SSH server fails or someone applies a bad firewall rule that prevents SSH access?
Comments
Depending on the cards and their configuration, you could generate the key outside (say, on a trusted machine at home) and upload it to the card. If the cards gets stolen, and you trust the security of the card to not leak the key, you could just get yourself a new one and upload the old key again.
The other philosophy is to generate the key on the RSA card, and never allow the card to export it. Then you consider the private key dispensable and will have to update all systems to accept a new card's private key.
update all systems to accept a new card's private key.
That sort of a chicken/egg problem though, right? It assumes you've got console or some other means of access that will take another credential.
I don't see a situation where you are unable to get console access as an acceptable situation. You don't need to be using a smart card to require local console access if things go bad. What about if the SSH server fails or someone applies a bad firewall rule that prevents SSH access?