docs: note OpenPGP card support and card-only key import in TODOHEADmaster

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/TODO.md b/TODO.md
index dc3bdde9..27ddf2da 100644
--- a/TODO.md
+++ b/TODO.md
@@ -10,6 +10,9 @@ Open work after 0.2.0. Remove an item in the commit that finishes it.
   `+refs/head/*:refs/remotes/$name/*`, with `head` where git uses `heads`, so nothing is fetched.
   Stores already set up this way keep the bad refspec in `.git/config`, so a fix must repair them
   too. Not confirmed by reading the store's config.
+- Key import accepts GnuPG stub and smartcard keyrings, whose secret parts live on a card: they
+  pass `KeyUtils.isSecretKey` and only fail at decryption. Refuse them at import with a clear
+  message (check for a secret subkey usable for decryption).
 
 ## Features and UI
 
@@ -19,3 +22,6 @@ Open work after 0.2.0. Remove an item in the commit that finishes it.
   it at runtime, so the QR scanner must be replaced. That alone is not enough: `androidx.biometric`
   depends on it too, for a fingerprint dialog unused at minSdk 31, so it must be excluded or
   `BiometricPrompt` used from the platform.
+- OpenPGP card support (NFC and USB): requested on the password-store mailing list (2026-11-09).
+  Upstream reached cards through OpenKeychain until PGPainless replaced it in 2.0; PGPainless has
+  no card support, so decryption on the card needs its own OpenPGP card (ISO 7816) layer.