The supposed ability to tap the yubikey button even on phishing sites and not actually give up working credentials was like the selling point.