Or the USB device could turn into literally anything else, from an ethernet interface to a keyboard. This is a classic case of overthinking your threat model an

Or the USB device could turn into literally anything else, from an ethernet interface to a keyboard. This is a classic case of overthinking your threat model and missing the more obvious attack vectors. And for enterprises that want to make sure people enroll with genuine keys (as they sometimes also use these keys as physical access tokens), they can already use the factory-set OTP slot (the one with the cc instead of vv code) to check if a token is actually from Yubico.