> Since the key doesn't have wifi or anything, how can the private key flow back to China? The bluetooth one has a bluetooth radio (obviously). I suppose it's

> Since the key doesn't have wifi or anything, how can the private key flow back to China? The bluetooth one has a bluetooth radio (obviously). I suppose it's conceivable that the firmware could have a backdoor that allowed exfiltration of the private keys via that radio. Such a backdoor could probably be used in a targeted way against particular people in public places like a airports or cafes. Given that Google is marketing these things towards high-value targets such as journalists, campaign advisors, and Google engineers; building such a backdoor would be very tempting. It wouldn't even have to be present in stock keys, if the shipments could be intercepted in the mail on their way to particular targets.