[JohnFen]

> They are supposed to be mathematically non-exportable, device-bound.

Which would make the whole scheme unworkable (at least for me).

[l11r]

I pair of hardware keys (Token2, Yubico, etc) has the benefits from both worlds.

[crote]

Except enrollability. Got a new account? You need physical access to both tokens to enroll it. Got a new token? You'll have to individually enroll every website - provided they even support multiple tokens at all...

Yubikey tried to solve this, for obvious reasons. Their proposal was DOA.

[l11r]

I believe it was DOA because it defeated the main idea of tokens.