If you are practicing NSA is out to get me security: USB tokens are probably the worst idea possible. They are practically unauditable (sure, maybe the design

If you are practicing NSA is out to get me security: USB tokens are probably the worst idea possible. They are practically unauditable (sure, maybe the design is open source, but is that actually what got put on the chip?) and specifically intended for cryptographic function by paranoid people who think they have something to hide. I.e. they are likely one of the first thing the NSA would target. And they are easy to target since everyone knows exactly how they will be used and what code will execute on them. You'd be better off going with an x86 chip and avoiding the obvious hardware backdoor channel of a bad RNG(though for key generation it's unlikely NSA would ever see enough bits from the RNG to crack it). Because it's a generic computer, you can't just break the chip by backdooring everything(e.g. make xor a nop). You'd need to screw with instruction only if it is part of a cryptographic operations and that would be very very tricky and use up a hell of a lot of the transistor budget.