[mr_mitm]

So that the friend, or someone who steals from the friend can impersonate me?

Proving your identity when you lost your proof of identity is still an unsolved problem if you ask me. At least in general, it seems that there is no one solution that works for everyone.

[upofadown]

Put a PIN on it...

You can remove the PIN later. The hardware key can be set up to wipe the device after, say, 10 incorrect guesses.

[taeric]

If it can be wiped on incorrect pin usage, you can be maliciously locked out of accounts relatively easily.

[upofadown]

Then you are going to know that the friend was messing with your hardware key. Better that than finding out they are willing to betray you by stealing from you.

[quickthrower2]

Only if that key is the only factor.