Why is it a goal though? I don't care. U2F to me is useful for protecting from stolen credentials on the web. These attackers will never have physical access t

Why is it a goal though? I don't care. U2F to me is useful for protecting from stolen credentials on the web. These attackers will never have physical access to my u2f device to clone it. If you fear people getting physical access to your u2f, they can simply use it if they also know the password. No need for cloning. And if they don't know the password, it's still useless. From that attacker's perspective, your security was reduced to password only. Which is still good, if you take care of your passwords.