Thanks a lot, that helps!

> This might be a scenario in which hybrids provide some protection, so that an attacker will need to compromise both your OS and have a CRQC.

Did you mean "your OS and have a CRQC" here, or "your Yubikey and have a CRQC"?

I mean "your OS and have a CRQC" because they will need to compromise the software PQ key by compromising the OS, and derive the hardware YubiKey private key using the CRQC.