Post #3085263

@zed@mstdn.party each click creates a signature based on the server’s challenge and the private key never leaves the physical key’s enclave so no (if yes that would be a MASSIVE failure in implementation, so far physical access seems like the most likely way of doing this), but there are some minor privacy considerations, like it can identify the brand and model of key you’re using etc