the biggest issue with the yubikey touch verification is that you have no way of telling what you're verifying, especially if some tool helpfully forwarded your agent, or is trying to maintain ssh connections in the background

first time you see the light blinking without doing anything intentional is a bit of a sinking feeling