Isn't using U2F+SSH CA's just moving the challenge-response protocol one level up? U2F is "just" a hardware P-256 key (or a set of keys unique to origin, but i

Isn't using U2F+SSH CA's just moving the challenge-response protocol one level up? U2F is "just" a hardware P-256 key (or a set of keys unique to origin, but ignoring privacy issues they are comparable, of course I'm assuming the same setup so touch-to-use set to required). (I've set up SSH CAs manually and I'm familiar with low level U2F for that matter).