> If someone were to steal your yubikey then they’d be able to perform a step that previously you’d have needed to be there for. Several security keys are prot

> If someone were to steal your yubikey then they’d be able to perform a step that previously you’d have needed to be there for. Several security keys are protected themselves with an additional factor. There are, for example, Yubikeys which are unlocked by your fingerprint: this now requires the thief to not only steal your Yubikey but also have the skills required to reproduce your fingerprint. There are also several U2F devices protected by a PIN. The "Only key" uses one PIN to register a service (which you do once per service) and another PIN to authenticate to the service (so you cannot easily be tricked into registering instead of authenticating). The Ledger Nano U2F app is also protected by a PIN and has its own little screen so it displays the name (or the identifier) of the service you're either registering or authenticating to (and tells you if you're actually going to register or authenticate), is protected by a HSM and factory resets itself after three wrong PIN. I'm using the later to SSH now (requires a moderately recent version of OpenSSH: latest Debian stable is sufficient for example).