I use Yubikeys to store my GPG and SSH private keys. This way even if my laptop gets 0wned, the attackers won't be able to get my private keys. It basically is a more convenient form factor then using a Smartcard (which was how I had previously stored by GPG / SSH keys).

Is there any simple way to keep SSH keys synced across multiple keys?

I have 2 laptops and an Android device, so if I was to start using these things it would be convenient to keep my private keys available across them all.

I don't think it's so much about features, but I do think there's a huge difference between having a nano and a normal sized one, especially on a laptop.

Being able to leave it in instead of having to take it out of your wallet and plug it in every time makes a big difference in usability, which in turn makes it much more likely that you'll want to use it everywhere.

It's funny because I see it the opposite way: the problem with the nano is you'll want to leave it in all the time, which reduces your practical security. I go out of my way to keep the security key on my physical keychain; I don't even like leaving it in my bag, where it might get stolen along with the computer.

What's the threat model this protects against?

(In other words, what's better about having the security key being on your keychain vs. be a permanent part of your computer)

I am less likely to lose both at the same time as I am to lose just one, and you'd need both of them to get access to accounts.

What do you mean you need both? The two in 2-factor is password + ubikey, not laptop + ubikey.

If someone gets your laptop with ubikey inside, they can't do anything without your password. And the whole point of a physical second factor is to basically limit the 99.9% of the people (mostly from other countries and cities) that have no physical access to you from hacking you.

It's "Yubikey", not "ubikey". The Nano and Y4 keys do more than U2F; they also generate and store RSA keys. They aren't just 2FA devices; they're also small HSMs.

If I have access to someone else's laptop with a nano key plugged into it, can I access all the SSH key files stored on the key, or are they also protected from access somehow?