+{%- endif %}
diff --git a/docs/source/_templates/layout.html b/docs/source/_templates/layout.html
new file mode 100644
index 0000000..665cc8e
--- /dev/null
+++ b/docs/source/_templates/layout.html
@@ -0,0 +1,96 @@
+{% extends "!layout.html" %}
+
+{# ── SEO / head ────────────────────────────────────────────────────── #}
+{% block extrahead %}
+{{ super() }}
+
+{% set canonical_url = pageurl | replace('index.html', '') if pageurl else 'https://docs.cryptnox.com/cryptnox-readers/' %}
+
+{# Page-specific social description.
+ SOURCE: a docinfo field at the very top of the .rst, before the title:
+ :description: One sentence about this page.
+ NOT the `.. meta::` directive -- docutils renders that straight to HTML and it
+ never reaches Sphinx's template context, so meta.get('description') cannot see it.
+ Pages with no :description: fall back to the site-wide blurb, unchanged.
+ The same value also feeds : the `.. meta::` directive
+ in the .rst files does not produce one. #}
+{% set page_description = (meta.get('description') if meta else None) or
+ "Compatibility documentation for Cryptnox USB smart card readers: national eID and professional cards by country, and FIDO2 services and platforms." %}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/docs/source/click-to-tap.rst b/docs/source/click-to-tap.rst
new file mode 100644
index 0000000..f7ec1d4
--- /dev/null
+++ b/docs/source/click-to-tap.rst
@@ -0,0 +1,121 @@
+:description: What the Cryptnox Click-to-Tap button does, why FIDO2 sign-in on a desktop contact reader needs it, what it requires, and how to troubleshoot it.
+
+.. meta::
+ :description: What the Cryptnox Click-to-Tap button does, why FIDO2 sign-in on a desktop contact reader needs it, what it requires, and how to troubleshoot it.
+
+============================================================
+Click-to-Tap: FIDO2 User Presence on a Desktop Reader
+============================================================
+
+*Last reviewed: 29 August 2026.*
+
+This page explains one button: what it is for, what it requires, and what it does not do.
+
+The problem it solves
+=====================
+
+FIDO2 and WebAuthn require a **user-presence check** on every authentication. The
+authenticator must prove that a human, and not software running unattended in the
+background, approved the sign-in. It is a deliberate part of the standard, not an
+implementation detail.
+
+A USB security key satisfies that check with a metal touch button. A smart card does not
+have one. When the card sits in an ordinary contact reader, the only gesture left that the
+host recognises as "a person did something" is **removing the card from the slot and
+inserting it again** — once per sign-in.
+
+That is slow, it wears the card contacts and the reader connector, and the card is out of
+the reader at exactly the moment the user is trying to work.
+
+How Click-to-Tap works
+======================
+
+Pressing the button drives the smart-card interface through a controlled
+**extraction-and-reinsertion sequence at the protocol level**. There is no mechanical
+movement: the card is never physically ejected. The host sees the card leave and return,
+which is the event it was waiting for, and the card stays seated in the slot.
+
+The effect is the contactless "tap" gesture, delivered on a contact-mode card.
+
+Requirements
+============
+
+.. list-table::
+ :header-rows: 1
+ :widths: 26 74
+
+ * - Requirement
+ - Detail
+ * - Card
+ - **Cryptnox FIDO2 smart cards only.** The button drives a Cryptnox-specific
+ signalling sequence; it is not a generic CCID feature.
+ * - Operating system
+ - **Windows.** The button has no effect on macOS or Linux.
+ * - Reader
+ - The Cryptnox Click-to-Tap USB-C contact reader. The contactless reader has no
+ button and does not apply.
+ * - Software
+ - None for the button itself. The reader is a standard USB CCID / PC-SC device and
+ uses the smart-card stack already present in Windows.
+
+With any other card, or on any other operating system, the device remains a fully
+functional standard CCID / PC-SC contact reader — you simply do not get the tap
+simulation.
+
+Using it
+========
+
+1. Plug the reader into a USB port. The indicator confirms it has power.
+2. Insert the Cryptnox FIDO2 card into the full-size slot, chip contacts down.
+3. Sign in to a FIDO2 / WebAuthn service as usual and choose the security key.
+4. When the prompt asks you to **tap your security key**, press the button on the reader.
+5. The sign-in completes. Leave the card in the slot for the next one.
+
+Troubleshooting
+===============
+
+**The button does nothing.**
+Check the three requirements above in order: it must be a Cryptnox FIDO2 card, on Windows,
+in the Click-to-Tap reader. Any one of the three missing produces exactly this symptom,
+with no error message.
+
+**The service never asks me to tap.**
+Then there is nothing for the button to answer. Some services complete without a
+user-presence prompt, and some browsers prompt only on first registration. The button is
+only meaningful while a prompt is waiting.
+
+**The card is not detected at all.**
+That is a reader or middleware question, not a Click-to-Tap question. Confirm the card is
+seated with the contacts facing down and fully inserted. On Linux, install ``pcscd``,
+``libccid`` and ``pcsc-tools``, then check that ``pcsc_scan`` sees the reader.
+
+**FIDO2 sign-in does not work on Linux.**
+Browsers on Linux expect an HID FIDO interface, which a CCID reader does not present by
+itself. Install the open-source `Cryptnox FIDO2 HID bridge
+`__. Note that this enables FIDO2
+sign-in on Linux — it does not enable the Click-to-Tap button, which remains Windows-only.
+
+**I want to use the button with my eID, PIV or CAC card.**
+Not possible, and not a defect. Click-to-Tap answers a FIDO2 prompt. Government cards
+authenticate through their own middleware and are unaffected by it. See
+:doc:`reader-compatibility` for what those cards need.
+
+What Click-to-Tap is not
+========================
+
+* **Not a replacement for the PIN.** User presence and user verification are different
+ checks. The card's PIN policy is unchanged.
+* **Not a security boundary.** The button is a convenience for a gesture the standard
+ requires; it neither adds nor removes cryptographic protection.
+* **Not a secure element.** The reader holds no keys, stores nothing and signs nothing.
+ Every cryptographic operation happens on the card.
+* **Not applicable to contactless cards**, which already tap physically.
+
+Provenance
+==========
+
+The Click-to-Tap virtual-button signalling is Cryptnox-engineered firmware layered on the
+standard USB CCID interface; the underlying reader hardware is a commodity component. The
+button is protected by registered Austrian utility model **GM 55114/2025**, registered
+German utility model **No. 202025108028.1**, and United States patent application
+**No. 19/534.472** (pending).
diff --git a/docs/source/conf.py b/docs/source/conf.py
new file mode 100644
index 0000000..7e617d6
--- /dev/null
+++ b/docs/source/conf.py
@@ -0,0 +1,81 @@
+# Configuration file for the Sphinx documentation builder.
+
+# -- Project information -----------------------------------------------------
+
+project = 'Cryptnox Smart Card Readers'
+copyright = '2026, Cryptnox SA'
+author = 'Cryptnox'
+release = '1.0'
+
+# -- General configuration ---------------------------------------------------
+
+extensions = ['sphinx_sitemap']
+
+templates_path = ['_templates']
+exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store']
+
+language = 'en'
+
+# -- SEO meta tags -----------------------------------------------------------
+
+html_baseurl = 'https://docs.cryptnox.com/cryptnox-readers/'
+html_title = 'Cryptnox Smart Card Readers'
+sitemap_url_scheme = "{link}"
+
+html_meta = {
+ 'description': 'Compatibility documentation for Cryptnox USB smart card readers: '
+ 'national eID and professional cards by country, and FIDO2 services '
+ 'and platforms.',
+ 'keywords': 'Cryptnox, smart card reader, USB-C, CCID, PC/SC, eID, FIDO2, NFC, '
+ 'ISO 7816, ISO 14443, extended APDU, documentation',
+ 'author': 'Cryptnox',
+ 'robots': 'index, follow, max-snippet:-1, max-video-preview:-1, max-image-preview:large',
+}
+
+# -- Options for HTML output -------------------------------------------------
+
+html_theme = 'sphinx_rtd_theme'
+html_static_path = ['_static']
+html_last_updated_fmt = '%Y-%m-%d' # visible page dates — AI answers prefer dateable sources
+html_logo = '_static/cryptnox-logo.svg'
+html_favicon = '_static/favicon.png'
+
+html_css_files = [
+ 'custom.css',
+]
+
+html_theme_options = {
+ 'analytics_id': 'GT-PJ7HDFB',
+ 'logo_only': False,
+ 'prev_next_buttons_location': 'none',
+ 'style_external_links': False,
+ 'style_nav_header_background': '#101f2e',
+ 'collapse_navigation': True,
+ 'sticky_navigation': True,
+ 'navigation_depth': 2,
+ 'includehidden': True,
+ 'titles_only': False,
+}
+
+html_show_sourcelink = False
+html_copy_source = False
+html_show_sphinx = False
+
+# -- Options for PDF (LaTeX) output ------------------------------------------
+
+latex_engine = 'pdflatex'
+latex_documents = [
+ ('index', 'cryptnox-readers.tex', 'Cryptnox Smart Card Readers',
+ 'Cryptnox SA', 'manual'),
+]
+latex_elements = {
+ 'papersize': 'a4paper',
+ 'pointsize': '10pt',
+ # pdflatex has no glyphs for the ✅/❌ marks used in the compatibility
+ # tables; map them to pifont's check and cross so the PDF builds.
+ 'preamble': r'''
+\usepackage{pifont}
+\DeclareUnicodeCharacter{2705}{\ding{51}}
+\DeclareUnicodeCharacter{274C}{\ding{55}}
+''',
+}
diff --git a/docs/source/fido2-compatibility.rst b/docs/source/fido2-compatibility.rst
new file mode 100644
index 0000000..6a505d9
--- /dev/null
+++ b/docs/source/fido2-compatibility.rst
@@ -0,0 +1,385 @@
+:description: Which services and operating systems work with a Cryptnox FIDO2 NFC card, as second-factor or passwordless sign-in, and where extra software is needed.
+
+
+.. meta::
+ :description: Which services and operating systems work with a Cryptnox FIDO2 NFC card, as second-factor or passwordless sign-in, and where extra software is needed.
+
+=================================================
+FIDO2 Card Compatibility — Services and Platforms
+=================================================
+
+*Last reviewed: 26 August 2026.*
+
+This page answers: **will a Cryptnox FIDO2 card sign me in to a given service, on the
+device I actually use?**
+
+The answer is never a single yes or no, because FIDO2 compatibility has two independent
+halves. Read your **platform** row, read your **service** row, and take the intersection.
+
+.. contents:: On this page
+ :local:
+ :depth: 1
+
+
+Table A — platform and transport
+================================
+
+This decides **which protocol is available at all**. It is a property of the operating
+system and the connection, not of the service.
+
+.. list-table::
+ :header-rows: 1
+ :widths: 16 20 22 42
+
+ * - Platform
+ - Transport
+ - Protocol available
+ - Notes
+ * - **Windows 10/11**
+ - NFC reader or contact reader
+ - full FIDO2 / CTAP2
+ - Broadest support. Works across all major browsers.
+ * - **iOS**
+ - NFC (hold card to top of phone)
+ - FIDO2 / CTAP2
+ - iPhone 7 and later, iOS 13.3+.
+ * - **Android**
+ - NFC
+ - **CTAP1 / U2F only**
+ - Android does **not** support CTAP2 over external NFC security keys. Most services
+ keep U2F backward compatibility, so second-factor sign-in works — but see the
+ worked example below.
+ * - **macOS**
+ - NFC reader or contact reader
+ - varies
+ - Support differs by macOS version and browser. Test before relying on it.
+ * - **Linux**
+ - contact reader
+ - FIDO2 **via a bridge**
+ - Browsers expect a HID interface; CCID smart card readers do not present one.
+ Requires the open-source `Cryptnox FIDO2 HID bridge
+ `_, a small daemon that presents
+ the card to the browser as an HID-FIDO device. **This applies to every FIDO2 use on
+ Linux** — second factor, passwordless, everything.
+
+Table B — services
+==================
+
+This decides **what the service accepts**. Nearly every service that supports security
+keys uses them as a **second factor**; passwordless is a smaller, explicitly enabled set.
+
+.. list-table::
+ :header-rows: 1
+ :widths: 22 16 18 44
+
+ * - Service
+ - Second factor
+ - Passwordless
+ - Setup guide
+ * - **Microsoft** (Entra ID / Account)
+ - yes
+ - **yes** (Entra ID)
+ - `guide `__ · `overview `__
+ * - **Google**
+ - yes
+ - **yes** (Advanced Protection)
+ - `guide `__ · `overview `__
+ * - **AGOV** (Switzerland)
+ - yes
+ - **yes**
+ - `registration guide `__
+ * - **SwissID** (Switzerland)
+ - yes
+ - —
+ - `registration guide `__
+ * - **login.gov** (United States)
+ - yes
+ - **no**
+ - Always requires a password in addition to MFA — the key is a second factor, never
+ the only one. `overview `__
+ * - **Apple**
+ - yes
+ - —
+ - `overview `__
+ * - **GitLab**
+ - yes
+ - —
+ - `guide `__
+ * - **Facebook**
+ - yes
+ - —
+ - `guide `__
+ * - **X / Twitter**
+ - yes
+ - —
+ - `guide `__
+ * - **Cloudflare**
+ - yes
+ - —
+ - `overview `__
+ * - **Shopify**
+ - yes
+ - —
+ - `overview `__
+ * - **Binance**
+ - yes
+ - —
+ - `overview `__
+ * - **Coinbase**
+ - yes
+ - —
+ - `overview `__
+ * - **Bitfinex**
+ - yes
+ - —
+ - `overview `__
+ * - **Bank of America**
+ - yes
+ - —
+ - `overview `__
+ * - **Dropbox**
+ - yes
+ - —
+ - `overview `__
+ * - **NordVPN**
+ - yes
+ - —
+ - `overview `__
+ * - **Fastmail**
+ - yes
+ - —
+ - `overview `__
+ * - **GoDaddy**
+ - yes
+ - —
+ - `overview `__
+ * - **SSH**
+ - yes
+ - —
+ - `guide `__
+
+A dash under *Passwordless* means the service has not enabled FIDO2-only sign-in, or we
+have not confirmed that it has — not that it is impossible. Test before relying on it.
+
+
+The composition rule
+====================
+
+**Your answer is the intersection of your platform row and your service row.** Both must
+allow what you are trying to do.
+
+The worked example is **Microsoft on Android**:
+
+* the card is CTAP2-capable ✅
+* Microsoft Entra ID is CTAP2-capable ✅
+* **the combination still fails** ❌
+
+Android speaks only CTAP1/U2F over an external NFC key, and Microsoft requires CTAP2 with
+user verification on every attempt — it does not accept U2F credentials. Use a reader on
+Windows, or NFC on iPhone.
+
+That single case teaches the whole model: **capability is not the same as a usable path.**
+A component being able to do something says nothing about whether the platform in front of
+it will ask.
+
+Two related consequences worth stating plainly:
+
+* **One card can appear twice in an account.** Registering the same card over CTAP1 on
+ Android and CTAP2 on desktop creates two separate credentials. That is expected.
+* **Cryptnox FIDO2 is listed by Microsoft** for Entra ID attestation (AAGUIDs
+ ``9c835346-796b-4c27-8898-d6032f515cc5`` and
+ ``1d1b4e33-76a1-47fb-97a0-14b10d0933f1``, both NFC). Attestation eligibility is not the
+ same as passwordless support, and individual server implementations of CTAP1 vary.
+
+
+Limitations
+===========
+
+* **Passwordless everywhere.** These are **MFA-first**: a hardware second factor on top of
+ a password. Passwordless works only where a service has explicitly enabled FIDO2-only
+ sign-in. login.gov is the clearest counter-example — it always requires a password.
+* **CTAP2 over Android NFC.** Second-factor U2F works on most services; Microsoft does not.
+* **Linux without the bridge.** A CCID reader alone will not satisfy a browser.
+* **Fingerprint on the card.** FIDO2 user verification on these cards is **PIN-based**.
+* **Migrate credentials between cards.** Each card holds its own keys. A replacement card
+ must be registered with each service again.
+* **Act as a USB device.** These are NFC and contact smart cards, not USB tokens.
+
+
+Common questions
+================
+
+**Does a FIDO2 security key card work with Android over NFC?**
+Yes for second-factor sign-in on most services, because Android supports CTAP1/U2F over
+external NFC keys and most services keep U2F backward compatibility. It does not work with
+Microsoft, which requires CTAP2 with user verification.
+
+**Which services support passwordless sign-in with an external NFC card?**
+A small set that has explicitly enabled FIDO2-only login — Microsoft Entra ID, Google
+Advanced Protection and AGOV among them. Most services accept the key only as a second
+factor on top of a password, and login.gov always requires one.
+
+**Why does my security key appear twice in my account settings?**
+Because CTAP1 and CTAP2 registrations create separate credentials. Registering the same
+card on an Android phone and on a desktop produces two entries. Both work.
+
+**What decides whether a given service and device combination works?**
+Three things: the card's capability, the platform's protocol support, and what the service
+accepts. In practice the platform is the usual blocker — most notably Android, which
+speaks only CTAP1 over external NFC keys.
+
+**Do I need extra software?**
+On Linux, yes — the open-source Cryptnox FIDO2 HID bridge, for every FIDO2 use. On Windows,
+macOS and iOS, no. Setting or changing the card PIN uses the Cryptnox app.
+
+
+Related
+=======
+
+* `FIDO2 card technical specifications `__
+* `Using the card with Android `__
+* `Windows setup guide `__
+* `Setting the card PIN `__
+* `Managing credentials on the card `__
+* :doc:`Smart card reader compatibility by country `
+
+
+.. raw:: html
+
+
diff --git a/docs/source/index.rst b/docs/source/index.rst
new file mode 100644
index 0000000..b3ded4e
--- /dev/null
+++ b/docs/source/index.rst
@@ -0,0 +1,54 @@
+:description: Compatibility documentation for Cryptnox USB smart card readers — national eID and professional cards by country, and FIDO2 services and platforms.
+
+.. meta::
+ :description: Compatibility documentation for Cryptnox USB smart card readers — national eID and professional cards by country, and FIDO2 services and platforms.
+
+============================
+Cryptnox Smart Card Readers
+============================
+
+`Download this documentation as a PDF `__
+
+
+Compatibility guides
+====================
+
+.. raw:: html
+
+
+
+
+
+*Cryptnox USB smart card readers* connect contact (ISO 7816) and contactless (ISO 14443)
+smart cards to Windows, macOS and Linux over USB-C. Both readers support extended APDU,
+which is what national eID schemes and ICAO 9303 travel documents require for certificates
+and signatures larger than the 255/256-byte short-APDU limit.
+
+* **Smart Card Reader Compatibility by Country** [`HTML `__] — national eID and professional card compatibility per country, with the official government middleware required for each
+* **FIDO2 Card Compatibility — Services and Platforms** [`HTML `__] — which services and operating systems work with a Cryptnox FIDO2 NFC card, second-factor or passwordless, and where extra software is needed
+* **Click-to-Tap — FIDO2 User Presence on a Desktop Reader** [`HTML `__] — what the Click-to-Tap button does, why FIDO2 sign-in on a contact reader needs it, its requirements, and troubleshooting
+
+.. toctree::
+ :hidden:
+ :maxdepth: 1
+ :caption: Compatibility guides
+
+ reader-compatibility
+ fido2-compatibility
+ click-to-tap
+
+
+-------------------------
+
+
+Other resources
+===============
+
+* `Cryptnox Product Documentation `_
+* `Cryptnox Website `_
+* `Cryptnox on GitHub `_
+* `Contact Cryptnox `_
diff --git a/docs/source/reader-compatibility.rst b/docs/source/reader-compatibility.rst
new file mode 100644
index 0000000..6a7c647
--- /dev/null
+++ b/docs/source/reader-compatibility.rst
@@ -0,0 +1,650 @@
+:description: Which national eID and smart cards work with Cryptnox USB smart card readers, country by country, with the official government middleware required for each.
+
+.. meta::
+ :description: Which national eID and smart cards work with Cryptnox USB smart card readers, country by country, with the official government middleware required for each.
+
+==================================================
+Smart Card Reader Compatibility by Country
+==================================================
+
+*Last reviewed: 27 August 2026.*
+
+This page answers one question, country by country: **will a Cryptnox USB smart card
+reader read my national ID or professional card, and what software do I also need?**
+
+Two rules govern every row on this page.
+
+**1. The reader is necessary but not sufficient.**
+Every national card scheme listed here also requires its own government middleware. A
+reader that meets the published specification will still do nothing until that software
+is installed. Where a scheme provides no freely installable software, this page says so.
+
+**2. Contact and contactless are different cards, not different modes.**
+A card with gold pads on the surface is a *contact* card and needs the contact reader. A
+card read by holding it near the device is *contactless* and needs the contactless reader.
+Some cards have both interfaces; many have only one. Getting this wrong is the single most
+common cause of a reader "not working".
+
+.. contents:: Countries on this page
+ :local:
+ :depth: 1
+
+
+Reader specifications
+=====================
+
+.. list-table::
+ :header-rows: 1
+ :widths: 22 39 39
+
+ * -
+ - Contact reader
+ - Contactless reader
+ * - Interface
+ - ISO/IEC 7816, Class A/B/C (5 V / 3 V / 1.8 V)
+ - ISO/IEC 14443 Type A **and** Type B, 13.56 MHz
+ * - Protocols
+ - T=0 and T=1
+ - 106 / 212 / 424 / 848 kbps
+ * - Extended APDU
+ - Yes
+ - Yes
+ * - Stack
+ - PC/SC 2.0, USB-IF CCID, Microsoft WHQL
+ - PC/SC, USB 2.0 CCID
+ * - Card power
+ - up to 500 mA
+ - not applicable
+ * - Operating systems
+ - Windows, macOS, Linux — no driver installation
+ - Windows, macOS, Linux, Android via USB OTG
+ * - Connector
+ - USB-C, with a USB-A adapter supplied
+ - USB-C, with a USB-A adapter supplied
+
+**Extended APDU support is the specification that decides most of this page.** Certificates
+and signatures on modern national cards routinely exceed the 255/256-byte short-APDU limit;
+readers without extended APDU fail precisely there, and the failure looks like a broken
+card rather than a broken reader. Both Cryptnox readers support it.
+
+
+Click-to-Tap on the contact reader
+==================================
+
+The contact reader carries a button the contactless reader does not: **Click-to-Tap**. It
+solves one specific problem, and it has no bearing on any national-card verdict below.
+
+FIDO2 and WebAuthn require a *user-presence* check on every authentication — proof that a
+person, and not software running in the background, approved the sign-in. A USB security
+key has a metal touch button for exactly this. A smart card sitting in an ordinary contact
+reader has nothing to touch, so the only gesture left is to pull the card out of the slot
+and push it back in, once per sign-in.
+
+Click-to-Tap replaces that gesture. One press drives the smart-card interface through a
+controlled extraction-and-reinsertion sequence at the protocol level, with no mechanical
+movement of the card, so the card stays in the slot.
+
+.. list-table::
+ :header-rows: 1
+ :widths: 28 72
+
+ * - Requirement
+ - Detail
+ * - Cards
+ - Cryptnox FIDO2 smart cards only. With any other card the device behaves as a
+ standard CCID / PC-SC contact reader.
+ * - Operating system
+ - Windows. On macOS and Linux the button has no effect; the reader itself works
+ normally on all three.
+ * - National eID cards
+ - Not applicable. Click-to-Tap is a FIDO2 feature and does not change whether a
+ government card can be read — that is decided by the country tables below.
+
+The button is patented technology: registered Austrian utility model **GM55114/2025**,
+registered German utility model **No. 202025108028.1**, and United States patent
+application **No. 19/534.472** (pending).
+
+Full detail, usage steps and troubleshooting: :doc:`click-to-tap`.
+
+
+How to read the verdicts
+========================
+
+.. list-table::
+ :header-rows: 1
+ :widths: 18 82
+
+ * - Verdict
+ - Meaning
+ * - **Works**
+ - Confirmed from the scheme's own published reader requirements *and* from users
+ reporting generic PC/SC readers in service.
+ * - **Likely**
+ - The interface and specification match, but community confirmation is thin or the
+ scheme itself warns that some readers fail. Test before deploying at scale.
+ * - **No**
+ - Interface mismatch, a mandatory homologation we do not hold, or the middleware
+ does not support this class of reader.
+
+
+Europe
+======
+
+Belgium — Belgian eID
+---------------------
+
+**Works with the contact reader.** The Belgian eID is a contact card. Belgian users report
+that generic budget readers of any age drive it, and readers well over a decade old remain
+in service. The card also carries a contactless interface, but the desktop software path
+is the contact one.
+
+*Middleware:* the free, open-source `eID Middleware and eID Viewer `_.
+
+Also covers the Kids-ID and the foreigner's card.
+
+Czechia — eObčanka
+------------------
+
+**Works with the contact reader.** The Czech Ministry of the Interior publishes a
+standards-based specification rather than an approved-model list: ISO 7816, CCID, PC/SC,
+with Microsoft WHQL and plug-and-play operation recommended for Windows. The Cryptnox
+contact reader meets all of them.
+
+*Middleware:* `eObčanka klient `_ — the card
+manager and identification tools.
+
+Estonia — ID-kaart
+------------------
+
+**Works with the contact reader.** Estonia's ID-card runs on the standard USB CCID driver.
+The national ID authority notes that any reader capable of retrieving data from the card
+can be used, while cautioning that it has only tested certain models itself.
+
+*Middleware:* `DigiDoc4 and the ID-software suite `_.
+
+Germany — Fahrerkarte and Personalausweis
+-----------------------------------------
+
+These are two different cards with two different readers, and confusing them is the most
+common German support case.
+
+.. list-table::
+ :header-rows: 1
+ :widths: 26 12 12 25 25
+
+ * - Card
+ - Contact
+ - NFC
+ - Middleware
+ - Verdict
+ * - **Fahrerkarte** (digital tachograph driver card)
+ - Yes
+ - No
+ - tachograph/DVR software, varies by vendor
+ - **Works** — contact reader
+ * - **Personalausweis** (nPA, eID function)
+ - No
+ - Yes
+ - `AusweisApp `_
+ - **Works** — contactless reader
+ * - elektronische Gesundheitskarte (eGK)
+ - Yes
+ - partial
+ - gematik TI stack
+ - **No** — a gematik-approved terminal is mandatory
+
+The Personalausweis eID function requires **extended length** APDU support: its
+certificates exceed 400 bytes and many inexpensive NFC readers cap at 261. AusweisApp
+states that a reader may work even if it is not on the tested list.
+
+Hungary, Latvia, Romania, Slovakia
+----------------------------------
+
+All four issue contact eID cards that work with the contact reader:
+
+* Hungary — eSzemélyi · `eSzemélyi Kliens `_
+* Latvia — eID · `eParaksts `_
+* Romania — CEI · `CEI app `_
+* Slovakia — eID karta · `eID klient `_
+
+Italy — TS-CNS and CIE
+----------------------
+
+**TS-CNS works with the contact reader.** The health/services card carries a contact chip
+and is driven by a per-card driver plus a smart card manager from the official list.
+
+**CIE 3.0 is contactless only** — it has no contact pads. Italian sources caution that not
+every contactless reader drives it reliably, so this is a *Likely*, not a *Works*.
+
+*Middleware:* `CIE Software `_.
+
+Luxembourg — eID
+----------------
+
+**Contactless reader only.** The Luxembourg government's own guidance specifies a
+contactless reader for the national eID.
+
+*Middleware:* `LuxTrust Middleware `_.
+
+Netherlands — UZI-pas and ZORG-ID
+---------------------------------
+
+**Contact reader, with an important limit.** The Cryptnox contact reader meets the UZI
+register's published reader specification — PC/SC, extended APDU support, and more than
+60 mA of card power.
+
+.. warning::
+
+ **UZI passes using 4096-bit RSA keys are a separate case.** SafeSign, the UZI
+ middleware, keys its maximum APDU size to a list of reader names and applies a
+ 255/256-byte default to any reader not on that list. A 4096-bit RSA signature is 512
+ bytes and cannot be returned under that default. Cryptnox readers are **not currently
+ on that list**, so a UZI pass carrying a 4096-bit key will not complete a signature
+ until they are added. This is a software list, not a hardware limit — the reader
+ itself supports extended APDU. Check the UZI register's approved-reader list and your
+ own software's supported-reader list before ordering.
+
+*Middleware:* `SafeSign `_.
+
+The Netherlands has no citizen contact card — DigiD is a phone and app scheme. The Belgian
+eID is widely used on Dutch desktops and is covered above.
+
+Poland — e-dowód
+----------------
+
+**Contactless reader.** The Polish e-dowód's electronic layer is contactless; there is no
+contact chip to read. The reader meets the MSWiA technical requirements: ISO 14443 Type A
+and B, extended APDU, PC/SC.
+
+*Middleware:* the free e-dowód software or the eDO App.
+
+Poland's tachograph driver card is a contact card and **works with the contact reader**.
+
+Portugal — Cartão de Cidadão
+----------------------------
+
+**Works with the contact reader.** Generic readers drive the card; note that some public
+service applications are reported to be fussy — that is the application, not the reader.
+The contactless interface is restricted to authorities.
+
+*Middleware:* `Autenticação.gov `_.
+
+Spain — DNIe
+------------
+
+**Works with the contact reader.**
+
+**Not with a desktop contactless reader.** The DNIe chip is dual-interface, but the desktop
+software path is not: OpenSC's DNIe driver recognises the contact ATRs only and does not
+work over a contactless reader, and the official NFC route (DNIeRemote / DNIeSmartConnect)
+uses a *mobile phone* as the reader rather than a USB one.
+
+*Middleware:* `DNIe software `_.
+
+Sweden — SITHS
+--------------
+
+**Contact reader, employer-supplied software.** On the hardware side the requirement is
+simply PC/SC compatibility, which the contact reader meets.
+
+.. note::
+
+ SITHS middleware is **not a free public download**. Net iD requires a commercial
+ licence, and Inera replaced it with SITHS eID in 2024. In practice the software reaches
+ the user through their employer. Do not plan on installing it independently.
+
+Finland's FINeID is a contact card and works with the contact reader, using
+`mPollux DigiSign `_ from DVV — note that
+DVV has stated this client is available only until the end of 2026.
+
+Switzerland — health insurance card, SwissPass and the e-ID
+-----------------------------------------------------------
+
+Switzerland produces more wrong expectations than any other country on this page, because
+most of what a Swiss resident carries is **not** a PKI smart card.
+
+.. list-table::
+ :header-rows: 1
+ :widths: 30 14 14 42
+
+ * - Card
+ - Contact
+ - NFC
+ - Verdict
+ * - **Versichertenkarte / VeKa** (health insurance card)
+ - Yes
+ - No
+ - **Works** — contact reader; professional software
+ * - **SwissPass** (SBB)
+ - No
+ - Yes
+ - Contactless reader, UID only — no certificate to authenticate with
+ * - **Identity card** (Identitätskarte)
+ - No chip
+ - No chip
+ - **No reader applies** — see the 2026 note below
+ * - **SuisseID**
+ - withdrawn
+ - —
+ - Discontinued; successor SwissID is an online account, not a card
+ * - **e-ID** (swiyu wallet)
+ - —
+ - —
+ - Phone app; no card, and no NFC planned at launch
+
+The **Versichertenkarte** is the one genuine Swiss contact smart card. Its chip follows
+`eCH-0064 `_
+and ISO/IEC 7816-4, and it carries insurance data plus optional emergency data. Note the
+market: it is read by **medical practice software**, not by a free public download, so this
+is a professional use case rather than a consumer one.
+
+**SwissPass** is a transport credential with ISO/IEC 14443 RFID tags. A contactless reader
+sees its UID; there is no certificate on it, so it cannot be used to sign or log in.
+
+**The Swiss identity card has no chip at all today.** A biometric identity card is planned
+for **2 November 2026**, and it will carry a chip of the same family as the biometric
+passport — ICAO 9303, **contactless** — while a chip-free card remains on offer. Until then
+no reader, of either kind, does anything with a Swiss ID card.
+
+**The federal e-ID is not a card.** It lives in the state
+`swiyu wallet app `_, its introduction has slipped to around
+the end of 2026, and NFC is not part of the launch design. No reader is involved.
+
+United Kingdom and Ireland
+--------------------------
+
+Neither country issues a national eID card. The **digital tachograph driver card** is a
+contact card and **works with the contact reader**, as does the **NHS Smartcard** in the UK,
+which is a contact smart card issued to health service staff and driven through the
+employer's identity agent software.
+
+Countries where a desktop reader is the wrong tool
+--------------------------------------------------
+
+Published here because knowing what *not* to buy saves more time than another compatible
+row:
+
+.. list-table::
+ :header-rows: 1
+ :widths: 22 78
+
+ * - Country
+ - Why a USB reader is not the route
+ * - Austria
+ - The Bürgerkarte was decommissioned in December 2023. ID Austria replaced it and
+ authenticates by phone or FIDO2 token — no card reader is involved.
+ * - Bulgaria, Cyprus, Slovenia
+ - The national schemes are mobile-first by design and steer citizens to a phone app.
+ * - France
+ - Carte Vitale and CPS require homologated terminals, which is a certification we do
+ not hold. The tachograph card is unaffected and works.
+ * - Greece
+ - The Greek ID chip is contactless RFID, not a contact chip.
+
+
+Outside Europe
+==============
+
+United States and Canada — CAC and PIV
+--------------------------------------
+
+**Works with the contact reader.** DoD CAC and federal PIV cards are contact cards for
+logical access, and the contact reader drives them.
+
+.. warning::
+
+ **A contactless reader cannot be used to log in with a PIV or CAC card.** Under
+ NIST SP 800-73, the card's PIN cannot be verified over the plain contactless interface
+ — only over the contact interface or a Virtual Contact Interface, and establishing a
+ VCI requires secure-messaging key establishment plus a pairing code. Without a PIN
+ there is no authentication. The contactless interface exposes the card's physical
+ access control credential only. Any product advertising contactless CAC login is
+ describing its *contact* slot.
+
+United Arab Emirates — Emirates ID
+----------------------------------
+
+**Works with either reader.** The Emirates identity authority's own developer
+documentation states that any PC/SC reader, contact or contactless, may be used. Note that
+the practical audience is organisational — registration desks, telecoms, banks, healthcare
+— because the consumer route is the UAEICP phone app.
+
+*Middleware:* `EIDA SDK Toolkit `_.
+
+
+Travel documents — ICAO 9303
+============================
+
+EU Regulation 2019/1157 requires member state ID cards to follow **ICAO Doc 9303**, the
+same specification as passports. The contactless reader reads ICAO 9303 electronic
+machine-readable travel document chips over ISO 14443 Type A and B, with extended APDU —
+which matters, because ePassport data groups routinely exceed the short-APDU limit and
+readers without extended APDU fail on them.
+
+What that does **not** mean:
+
+* The chip is password-protected. Access keys are derived from the **MRZ** (document
+ number, date of birth, expiry date) or from the **CAN** printed on the document.
+* It requires **MRTD reading software**, which Cryptnox does not supply.
+* It yields document data and the facial image only. **Fingerprints are protected by
+ Extended Access Control and are available to authorities only.**
+* It is not the eID authentication or signature function, which is a different applet.
+
+
+What these readers cannot do
+============================
+
+* **125 kHz cards** — EM4100, HID Prox and similar low-frequency badges. The contactless
+ reader is 13.56 MHz only.
+* **iPhone and iPad** — neither reader works with them.
+* **Contact and contactless at the same time** — these are two separate products.
+* **PIN entry on the reader** — neither has a keypad, so schemes that mandate on-device
+ PIN entry are out of scope.
+* **Click-to-Tap with a government card** — the button answers the FIDO2 user-presence
+ prompt for Cryptnox FIDO2 cards on Windows. It has no effect on eID, PIV or CAC sign-in.
+* **Guarantee the government's software.** We can state that the reader meets a scheme's
+ published requirements. We cannot promise how a given public-service application behaves.
+
+
+Common questions
+================
+
+**What kind of card reader do I need for the Belgian eID?**
+A contact smart card reader with PC/SC support, plus the free eID Middleware from
+eid.belgium.be. Generic readers work; there is no approved-model requirement.
+
+**Which USB card readers work with the Czech eObčanka?**
+Any reader meeting the Ministry of the Interior's published specification — ISO 7816,
+CCID, PC/SC, ideally WHQL-certified and plug-and-play. There is no approved-model list.
+
+**Does the Click-to-Tap button work with my national eID card?**
+No. Click-to-Tap answers the FIDO2 user-presence prompt, and only for Cryptnox FIDO2 smart
+cards on Windows. National eID, PIV and CAC cards are unaffected by it: whether they work
+depends on their interface and their own middleware, exactly as set out above.
+
+**Why does my reader work in one country but not another?**
+Three things have to line up: the card's interface (contact or contactless), the reader's
+specification (PC/SC, extended APDU, voltage class), and the national middleware. In
+practice the middleware is the most common blocker — it may support only one interface, be
+restricted to an approved list of reader names, or not be publicly downloadable at all.
+
+**Do I need extended APDU support?**
+For the German Personalausweis, ICAO 9303 travel documents, and any scheme using 3072- or
+4096-bit RSA keys, yes. Certificates and signatures at those sizes exceed the 255/256-byte
+short-APDU limit, and a reader without extended APDU fails on them.
+
+**Does one reader cover several countries?**
+For contact cards, largely yes — Belgium, Czechia, Estonia, Slovakia, Hungary, Latvia,
+Romania, Portugal, Spain, Finland and the UK/Irish tachograph card all run on a
+standards-compliant PC/SC contact reader. The middleware differs per country; the hardware
+does not.
+
+
+Related
+=======
+
+* :doc:`FIDO2 card compatibility — services and platforms ` — which
+ online services and operating systems work with a Cryptnox FIDO2 card, as a second
+ factor or passwordless, and where extra software is needed.
+
+
+Sources
+=======
+
+Every verdict on this page is drawn from the scheme's own published reader requirements
+and, where available, from user reports of generic readers in service. Government
+middleware pages are linked inline above. Standards referenced: ISO/IEC 7816, ISO/IEC
+14443, ICAO Doc 9303, NIST SP 800-73, EU Regulation 2019/1157.
+
+
+.. raw:: html
+
+
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..5091075
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,3 @@
+sphinx
+sphinx-rtd-theme
+sphinx-sitemap