I still feel like this kind of thing should be able to be done with a usb flash drive. Like an encrypted drive that has something like an ssh key in it or such. I really hate there is not something more agnostic for this type of purpose.
A lot of the extra value in something like a YubiKey is that they’re tamper evident.
Also any process can potentially read data off a USB stick once it’s mounted. With a FIDO2 key reading it requires a physical action.
I think it could be setup to allow limited access although im not really sure about tamper resistance. I just don’t like these things to be cheaper and not limited to particular companies or such.
Yubico isn’t the only company. There’s others that make hardware keys according to the same protocols, so if you just don’t like Yubico for whatever reason, there’s other options.
But the reason you want a key that isn’t a USB drive is the fact that you don’t want anyone to be able to extract the keys from your device either through software or by physically attacking it. A small few USB drives have encryption, but I don’t know what attacks they can withstand.
A USB drive is trivially easy, because you need it to be. You don’t want that same ease for a security device.
