I think you're making this too complicated, unless I'm missing something. If your system is compromised, the attacker can steal your session key (from your cook

I think you're making this too complicated, unless I'm missing something. If your system is compromised, the attacker can steal your session key (from your cookies or whatever else the site uses). That's just about as good as your U2F key, with some defense-in-depth exceptions that I mentioned here[1]. [1]: https://news.ycombinator.com/item?id=15044826 https://news.ycombinator.com/item?id=15044826