Thanks, then I don’t see how this is newsworthy.

If you have physical access to the Yubikey, you can just tap it to get it to sign. No exfiltration necessary.