If your personal threat model includes physical attacks on a U2F key, then it's unlikely the key is the weak link. The attacker would more likely use that physi

If your personal threat model includes physical attacks on a U2F key, then it's unlikely the key is the weak link. The attacker would more likely use that physical access to root your computer. If your threat model does not include physical attacks, then any U2F device (except software-based ones) is fine.