But if that hardware key is privacy-preserving (i.e. websites don't get your identity when you use it), what prevents you from using it for your illegal activity? Scrapers and spam are built by humans, who could get such a hardware key.
Not even: the government is supposed to provide you with more than one token (how would you verify yourself as a human to more than one website otherwise?)
