Suppose I have a small organization, every user has a recent Macbook Pro, can buy a ~$25 smart card reader on Amazon, and I want to use keypairs where the private keys are on personal smartcards to do email encryption and SSH authentication.
It seems most of these readers are geared towards the DOD CAC or Federal PIV infrastructure. I do not need to integrate with these things - I want to own the root CA or just manually put everybody's public keys in some kind of directory.
What are the different kinds of commercially available smart cards, and what do I need to stick to (or steer clear of) to get something working reliably at small scale using open source software? It seems the many vendors have different implementations and it's not clear how interoperable they are (if it all) outside of their enterprisey Windows-based software.
Basically, I'm looking to do something similar to what the Yubikey Neo does, but with generic cards (ideally having multiple suppliers) and readers. I understand specific product recommendations are off topic, just looking for a rundown on what words to look/search for to find cards that can be used for this purpose.
Terms I've come across:
ISO7816 seems to be a standard electrical interface, but I'm not sure whether this means all ISO7816-compliant cards and readers are interoperable at a software level.
CCID seems to be a standard protocol overlaid on USB for communication with card readers.
PKCS#11 and PCKS#15 seem to be higher-level public key crypto primitives that i.e. Thunderbird can consume from a smart card.
Can I just use any ISO7816 cards and readers compatible with both CCID and ISO7816, or is there more to it then that?