[mpalmer]

This is public-key-crypto-based authentication for the average user who will almost certainly never buy a security key but who probably owns a device that offers secure identity verification (laptop, phone).

Yubikeys are great but they're super niche. Among Android users alone there might be a billion people who will never buy one.