Oh, that's a good point – I personally never use my security key at untrusted computers, but I guess this could be a somewhat common use case.

> If you assume there is never any malware on the host then you don't need the key at all—the host can store the secrets and handle the authentication on its own.

True, a permanently plugged in authenticator is largely equivalent to just using a password manager (which also prevents against skimming, if used exclusively via autofill, never via copy/paste), but unlike a password mananger, it makes unsafe actions explicitly impossible for non-sophisticated users. I'd consider this a strong advantage.

It also survives OS reinstalls, ransomware etc.