Getting a security key with physical PIN entry to play nicely with Qubes split RPC

How to set up split-gpg2, because there's a lot of wrong info out there