He could have said it, instead of leaving it vague. In this case, reference to Yubikey is not so relevant, since it was 2FA code that was hacked. If he wanted

He could have said it, instead of leaving it vague. In this case, reference to Yubikey is not so relevant, since it was 2FA code that was hacked. If he wanted to use Yubikey with no fallback, he should have used Advanced Protection plan to force Yubikey.