I'm using a Yubikey that is permanently plugged into a USB-C port on my laptop and another one in my dock at home.

> Except that those "self-contained hardware modules" are actually rarely "self-contained" but usually an integral part of a smartphone running a huge bunch of mostly-untrusted code and that the containment keeps getting breached, of course.

And it actually doesn't matter if the secure device is designed correctly. Providing a secure channel over untrusted networks is something that we can do easily.

> And you still don't get to use Passkeys with banks, of course.

I can. I'm using US Bank and it supports my Yubikey-bound WebAuthn credential just fine.