Slots: 9A PIV Authentication (log-in, PIN required), 9C Digital Signature (documents, e-mail, code; PIN for every signature), 9D Key Management (decryption and key agreement), 9E Card Authentication (physical access, usually without PIN), plus retired key-management slots 82–95 and an attestation slot F9 on YubiKeys. Keys are RSA-2048, ECC P-256 or P-384 (newer tokens add more algorithms); certificates are X.509.
Because the key never leaves the card, PIV is used beyond government for SSH (via PKCS #11), code signing with hardware-held keys, Windows smart-card logon and mTLS. Device attestation certificates prove that a key was generated on the token, which certificate authorities can require for code-signing keys. The YubiKey attestation verifier checks such statements.