We do support firmware upgrade, unlike other security keys. For example in 2020 we patched a couple security issues, while Yubico, Google Titan and Feitian all recalled keys. Specs and thus firmware are getting bigger and more complex, so we believe that updates are the only way to maintain security in the long run.
We do not use a secure element, unlike other keys. This is not a statement, it’s just a fact. If you want an open product, there’s no “secure element” available that doesn’t require an nda. We hope that our work (we’re not alone in this) will motivate manufacturer to release secure elements with less obscurity around them.
My biggest problem is not the key.
My biggest problem is the fact that I can't easily roll keys out in a startup with 5 people and not become the customer service IT person handling security problems every day.
Solve THAT problem and I'll pay a monthly fee for your service.
That threat is so far off the typical path that it can't even see civilization anymore.
However, simply encasing the key in acrylic would solve your use case.
These keys are meant to solve the typical remote attacks like phishing--and they do that extremely well.
They also are quite good at stopping the: "Someone stole my laptop and now has access to everything." If the key is on your keychain, that scenario is stopped cold.
These keys are not really meant to solve one-to-one attacks by determined adversaries. And, to be fair, such an adversary is going to compromise your OpSec LONG before he tries to compromise your key.
There’s a reason Yubikeys can’t be updated, and it’s not to sell more Yubikeys.