Generally I trust my U2F that has a simple button on it to not reveal it's private key much more so than a hugely complicated smartphone. Especially the button

Generally I trust my U2F that has a simple button on it to not reveal it's private key much more so than a hugely complicated smartphone. Especially the button, which makes it very hard for a remote attacker to get anything from the U2F token. How many apps are on your phone? How secure is the software stack? Kernel? Hardware? Drivers? If android, how good is your manufacturer + cell provider at distributing the latest updates? Can you prove that an app can't see the screen and send a touch event? Also generally it's faster to hit the single button on a U2F widget than it is to do anything with a smartphone.