A lot of absolutes are being thrown around in the comments here, unfortunately. It really depends on your scenario. Generating keys exclusively in (non-backup-

A lot of absolutes are being thrown around in the comments here, unfortunately. It really depends on your scenario. Generating keys exclusively in (non-backup-able) secure hardware is great if your scenario readily supports multiple keys per server/domain you're authenticating in. Creating an airgapped backup and loading that into a "daily driver" Yubikey marked as non-exportable can be perfectly fine if that's not the case and you don't want to notify the world every time you're adding or retiring a new Yubikey (for reasons other than key compromise).