I agree that it would look bad if Yubico pretended to send patched keys and instead sent the vulnerable ones (which this anonymous reader seems to claim). But

I agree that it would look bad if Yubico pretended to send patched keys and instead sent the vulnerable ones (which this anonymous reader seems to claim). But I think it would deserve more than an anonymous, unverified claim. For what I see, on Yubico's store it says which version of the firmware I am ordering.