I think we agree that the many eyes maxim isn't as big of a factor as some might make it out to be, perhaps it's more of a "the devil you know" situation. With

I think we agree that the many eyes maxim isn't as big of a factor as some might make it out to be, perhaps it's more of a "the devil you know" situation. With hardware there isn't a lot of transparency around the implementations that are used, so it just makes me feel uncertain. I'd rather throw my lot in with OpenSSL and GPG than unknown library X. Also, it wasn't just Yubico products that were impacted by the vulnerability. It was estimated that 25% of all TPM devices globally were impacted, which adds up to millions of smartcards.