Done with @lelutin during his onboarding, tpo/tpa/team#41599

howto/yubikey.md

@@ -681,6 +681,14 @@ Then keys should *not* be present in the keyring:
 In the above, we can see the secret keys are not present because they
 are marked `sec>` and `ssb>`, not `sec` and `ssb`.
 
+At this point you can try removing the key to confirm that the secret
+key is *not* available, for example with the command:
+
+    gpg --clear-sign < /dev/null
+
+This should ask you to insert the key. Inserting the key should GnuPG
+to output a valid signature.
+
 ### Touch policy
 
 This is optional.