Unlike a cert file, a hacker can't steal the keys in a Yubikey if the machine is compromised. Same reason why many enterprises prefer using TPMs for storing mac

Unlike a cert file, a hacker can't steal the keys in a Yubikey if the machine is compromised. Same reason why many enterprises prefer using TPMs for storing machine certs. The advantage of a Yubikey over a TPM in this case is that the Yubikey requires a physical tap before it'll sign a request, which prevents certain MITM attacks.