[kingcharles]

You'd have to be an NSA-level target for them to take a Yubikey out of the mail stream and modify it. And at that point you're going to have all sorts of worse things to worry about.