AFAIK, there's no "codes in stasis" in U2F. http://google.com/ http://google.com/ sends you a challenge, your U2F device receives the challenge and makes a resp

AFAIK, there's no "codes in stasis" in U2F. http://google.com/ http://google.com/ sends you a challenge, your U2F device receives the challenge and makes a response signed with the private keypair that exists. Each CR pair is nonced and only valid for the originating site.