According to the yubico explanation linked from article, U2F includes cloning protection (an authentication counter, which the site should check has increased vs. its last known value), so that might not actually work if the site you are authenticating against is well-implemented (Unless the Nano S also lets you back up the counter value).
I'm using it on several sites and already did swap / reinitialize my U2F devices... It works, including on GMail. As I understand it the most recent Webauthn is going to be supported by Ledger soon.
I don't think they're non-compliant or badly implemented websites: although I'm not sure what the specs say.
I do personally love that I can back up my "seed" and know that by going to pick my safe at the bank I'll always be able to reinitialize an U2F device and I'll also really love that it displays "Google" on the Ledger Nano S's tiny screen.
Pricey little thing to use as "only" an U2F device: about 60 USD but I like it a lot.
> (Unless the Nano S also lets you back up the counter value)
Late reply but... As I understand it as long as the counter is monotonic it'll always work. What Ledger does (and apparently the Trezor too from reading this thread, another device with an HSM) is, upon initializing the U2F app the first time on your hardware device, is to set the counter to the current timestamp.
So basically: once you use another device to log in, then you cannot use the old one, unless you reinitialize it (and then it's the other you cannot use, unless you reinitialize it etc.). These devices do not have a clock, which is why it works that way (in the case of the Ledger Nano S / Ledger Nano X at least).
But isn't it the whole point that these devices never let you have the secret?
You may have thought (as I did at first) they meant a Yubikey; there is after all also a model called 'Nano', but not, I think, 'Nano S'.
> Since the U2F device creates and stores asymmetric key pairs, and is able to sign arbitrary “challenges”, can I use it as a general-purpose hardware key store?
You can however do it "the other way round" and use a private key to derive a U2F path. And that same private key can be used for many other applications (or none). For example you can use the Ledger Nano S (originally a cryptocurrencies hardware wallet), which has an HSM, with your "seed" (say a 256-bit secret, stored as 24 words you hide), to log in sites using U2F.
Additionally as long as you've got your secret, you can reinitialize your Nano S (or another one) as a new U2F device and there's no need to reset your U2F credentials on the site as the newly initialized device shall work exactly as if it was the old one.
Fun fact: the CTO of Ledger was part of the group working on the original FIDO specs.