1. Yes, it's called attestation, and you can read more here [1]. For example recently Amazon launched support for U2F only allowing some yubikeys. 1b. Solo wil

1. Yes, it's called attestation, and you can read more here [1]. For example recently Amazon launched support for U2F only allowing some yubikeys. 1b. Solo will have its own attestation certificate, so you'd be able to say I wan't/don't want to accept Solo. I believe this will be more valuable to enterprise/closed environments that publicly available services, but of course an option. 2. FIDO2 and "1" (U2F) work pretty much the same. The device signs a challenge together with the hostname of the website you're visiting. There's no release of any key material. Yubikes, other than FIDO2/U2F, support other protocols including OpenPGP or SSH, but this is kind of a different story. Makes sense? [1] https://fidoalliance.org/fido-technotes-the-truth-about-attestation/ https://fidoalliance.org/fido-technotes-the-truth-about-atte...