They do have a device counter, incremented on every usage, to help detect cloning. It's up to the server whether to enforce the constraint that the counter incr

They do have a device counter, incremented on every usage, to help detect cloning. It's up to the server whether to enforce the constraint that the counter increase on every usage. Unfortunately this means that the token does need a little bit of memory. I don't know whether FIDO2 has the same design.