There’s the U2F Zero https://github.com/conorpp/u2f-zero/wiki/Building-a-U2F-Toke... but of course there’s always a reflections-on-trusting-trust issue: you’ve got to get your CPU, CPU design, compiler, firmware and chip programmer somewhere!

Of course, an accidental software bug is probably more likely than intentionally backdoored hardware targeting you personally...