Nitrokey vs Feitian FIDO Keys

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round drawn
   Nitrokey—none0/10

   Probes explicitly confirm no llms.txt or agent-oriented docs endpoint exists (404s), and no evidence of AI-native documentation is present anywhere in the pack.

   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://docs.nitrokey.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   Feitian is a hardware FIDO key vendor with no evidence of an llms.txt or agent-oriented documentation; probes explicitly show 404s for llms.txt, markdown docs, and OpenAPI endpoints.

   • [probe] “PROBE llms.txt: HTTP 404 at https://fido.ftsafe.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://fido.ftsafe.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://fido.ftsafe.com/openapi.json, https://fido.ftsafe.com/swagger.json, https://fido.ftsafe.com/…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed4/10

   Nitrokey ships an official CLI (nitropy) that installs headlessly via pip/uvx and can be scripted, which is the closest evidence to CI-style automation (nitrokey-docs-14, nitrokey-probe-4, nitrokey-probe-rt-1). However, there is no documentation of CI pipelines, headless authentication flows, or automation guides, and the core use cases (FIDO2/OTP/PGP) inherently require physical touch presence, limiting true headless operation. Missing for 10: explicit CI/automation documentation, examples of nitropy used in pipelines, and clarification on how touch-required operations are handled headlessly.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

3. ai-native userUse an official CLI

   weight 2 · round to Nitrokey
   Nitrokey✓fullprobed8/10

   Nitrokey ships an official, actively maintained CLI (nitropy) documented at docs.nitrokey.com and verified at runtime to install cleanly via PyPI/uvx and report its version, confirming it works as claimed for scripting/automation-style interaction with the device. Missing for 10: no evidence of AI-agent-specific integration, tool-calling support, or third-party corroboration of the CLI's use in agentic workflows.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

4. ai-native userDrive the product through a documented public API

   weight 3 · round to Nitrokey
   Nitrokey~partialprobed5/10

   Nitrokey ships a documented CLI/SDK (nitropy, pynitrokey) that lets scripts/agents drive the hardware token programmatically, confirmed by runtime probes showing it installs and runs from PyPI. However, there is no REST/OpenAPI-style public API — explicit probes for llms.txt, docs-md, and openapi.json all 404 — so an AI agent has no network-callable documented API, only a local CLI/SDK. Missing for 10: a documented HTTP/OpenAPI public API, machine-readable API spec, and any AI-agent-specific integration guidance.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://docs.nitrokey.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   Feitian FIDO Keys are hardware authentication devices with no documented public API for programmatic/agentic control; probes for llms.txt, docs-md, and OpenAPI specs all returned 404, and no evidence describes any API surface for AI agents to drive.

   • [probe] “PROBE llms.txt: HTTP 404 at https://fido.ftsafe.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://fido.ftsafe.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://fido.ftsafe.com/openapi.json, https://fido.ftsafe.com/swagger.json, https://fido.ftsafe.com/…”

   proof ↗⚑ flag

5. ai-native userBuild against official SDKs

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed6/10

   Nitrokey publishes an official CLI (nitropy) and a Python SDK (pynitrokey) on PyPI, both confirmed working via runtime probes, and firmware/source are open on GitHub — giving developers a real path to build against official tooling. However there's no evidence of broader multi-language SDKs, API references beyond nitropy, or any AI/agent-specific integration surface (no OpenAPI, no llms.txt, probes for both 404). Missing for 10: multi-language/official SDKs beyond Python, formal API docs/OpenAPI spec, AI-agent-specific integration examples.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [github] “The Nitrokey 3 firmware is written in Rust. It uses the Trussed firmware framework and is developed in collaboration with SoloKeys”
   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Api quality

1. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   Nitrokey—none0/10

   Nitrokey is a hardware security key vendor; the probe explicitly checked for a machine-readable API spec (openapi.json, swagger.json, etc.) and all candidates returned 404, with no OpenAPI/Swagger spec documented anywhere in the evidence pack.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   Feitian's FIDO key documentation covers WebAuthn/FIDO2 standards and setup guides but no OpenAPI/Swagger spec is published; explicit probes for llms.txt, docs-md, and openapi.json all returned 404.

   • [probe] “PROBE llms.txt: HTTP 404 at https://fido.ftsafe.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://fido.ftsafe.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://fido.ftsafe.com/openapi.json, https://fido.ftsafe.com/swagger.json, https://fido.ftsafe.com/…”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round drawn
   Nitrokey—none0/10

   Nitrokey ships a CLI (nitropy) and Python SDK that could in principle be scripted, but no evidence in the pack shows any documented bulk-operation workflow (e.g., batch provisioning, mass key management, scripted multi-device automation) for AI-native or automated bulk use. Only single-device/product feature lists and an 'Entra ID provisioning' mention appear, with no concrete bulk-operation documentation or example. missing for 10: documented bulk/batch API or CLI commands, evidence of managing many items/devices at once, automation examples for large-scale provisioning.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [claimed-docs] “Nitrokey Provisioning for Entra ID”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Openpgp

1. developerKeep OpenPGP keys on the device and use them for git commit signing and encrypted email

   weight 2 · round to Nitrokey
   Nitrokey✓fullclaimed8/10

   Nitrokey devices support the OpenPGP smart card standard with on-device key generation, touch confirmation, and documented integration with Thunderbird for encrypted email; the OpenPGP card standard is also the basis for git commit signing via GPG, which is a well-known standard use case for OpenPGP smart cards. Docs explicitly cover keygen-on-device, touch confirmation, and Thunderbird email use. Missing for 10: explicit first-party documentation naming 'git commit signing' as a use case, and independent hands-on corroboration of the OpenPGP-card signing workflow.

   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “Keygen on device”
   • [claimed-docs] “Thunderbird”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   Evidence covers FIDO/U2F, PIV, OTP, and OpenSSH use cases, but there is no mention of OpenPGP key storage, git commit signing, or encrypted email support anywhere in the pack.

   ⚑ flag

Otp

1. power userThe key covers legacy one-time-password schemes — TOTP/HOTP slots or challenge-response — for services that still lack WebAuthn

   weight 2 · round drawn
   Nitrokey~partialclaimed6/10

   Docs explicitly list 'Two Factor Authentication' and OTP support (login using OTP for Google/Facebook), and the Nitrokey 3 product page mentions 'one-time passwords' among combined features, indicating TOTP/HOTP slot support. However, no explicit mention of HOTP challenge-response mode, no detail on number of slots, no independent hands-on verification of OTP functionality, and community evidence focuses on other features (HSM, durability) without confirming OTP reliability. Missing for 10: explicit challenge-response documentation, slot-count/configuration details, independent hands-on confirmation of OTP/HOTP working as advertised.

   • [claimed-docs] “Login to websites (e.g. Google, Facebook) using secure One Time Passwords (OTP), U2F or ordinary static passwords.”
   • [claimed-docs] “Two Factor Authentication”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed6/10

   Feitian documents HOTP functionality that emulates HID keyboard to auto-type OTP values, plus an OTP Tool to switch protocols and an SK Manager to manage OTP/PIV/FIDO functions, confirming legacy OTP slot support beyond WebAuthn. However, there's no detail on TOTP support, challenge-response mode, or number of OTP slots available. Missing for 10: TOTP-specific documentation, challenge-response mode details, slot capacity/configuration specifics, and independent hands-on verification.

   • [claimed-docs] “The HOTP function of FEITIAN FIDO Security Key emulates HID Keyboard protocol to enable automatically type the value in.”
   • [claimed-docs] “Learn how to use OTP Tool to switch protocol with FEITIAN FIDO security key.”
   • [claimed-docs] “Learn how to use FEITIAN SK Manager tool to manager your security key 's functions including FIDO, PIV, OTP.”

   proof ↗⚑ flag

Piv

1. it adminThe key acts as a PIV smart card for certificate-based login — workstation sign-in, VPN, and code signing with keys that never leave the device

   weight 2 · round drawn
   Nitrokey~partialcommunity6/10

   Nitrokey documents PIV support explicitly (nitrokey-docs-11) plus Windows Login/AD, S/MIME, PAM (Linux), OpenVPN and on-device keygen with touch confirmation (nitrokey-docs-5,6,7,8,15), covering workstation login, VPN and code-signing-adjacent use cases with non-exportable keys. However, code-signing evidence is limited to CLI/attestation tooling rather than a dedicated PIV code-signing workflow, and community reports flag missing feature parity and cryptographic limitations (Ed25519 unsupported, non-standard attestation cert formats) versus competitors, plus slow/incomplete rollout of promised features. Missing for 10: dedicated PIV-specific code-signing documentation/integration guide, independent hands-on verification of PIV smart-card login working end-to-end, and confirmation that PIV certs are exportable/usable in enterprise CA workflows.

   • [claimed-docs] “PIV (Personal Identity Verification)”
   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [claimed-docs] “Keygen on device”
   • [claimed-docs] “PAM (Linux)”
   • [claimed-docs] “OpenVPN”
   • [community] “I'm currently using both Nitrokeys and YubiHSMs on a client project. Nitrokeys can't do Ed25519, stuck with NSA Suite B for ECC. Attestation…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed6/10

   Feitian documents PIV smart card functionality via the SK Manager tool, including macOS PIV smart card logon configuration and general PIV/FIDO/OTP management, supporting workstation sign-in use cases. However, evidence does not explicitly confirm VPN certificate-based authentication or code signing use cases with PIV, nor detail Windows/Active Directory PIV smart card logon specifically. Missing for 10: explicit VPN certificate-auth documentation, code-signing workflow evidence, Windows PIV smart card logon docs, and independent/third-party validation of PIV compliance.

   • [claimed-docs] “Learn how to use FEITIAN SK Manager tool to manager your security key 's functions including FIDO, PIV, OTP.”
   • [claimed-docs] “Learn how to use FEITIAN SK Manager to configure macOS PIV smart card log on.”

   proof ↗⚑ flag

Ssh

1. developerMy SSH keys can be hardware-backed on the device — via FIDO2 sk-ssh keys, PIV, or OpenPGP — so server access requires a physical touch

   weight 2 · round drawn
   Nitrokey~partialcommunity6/10

   Docs confirm SSH login via certificates, PIV support, and OpenPGP card with touch confirmation, and a dedicated 'SSH Keys' page under the FIDO2 section suggests sk-ssh key support, aligning with the hardware-backed SSH story. However, there's no explicit walkthrough of FIDO2 sk-ssh key generation/usage, and community threads note the Nitrokey 3 has lagged in reaching feature parity with competitors, raising some doubt about full FIDO2 SSH robustness. Missing for 10: explicit sk-ssh setup documentation/examples, independent hands-on confirmation of FIDO2 SSH touch-to-authenticate working end-to-end.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Login to computers and network services (e.g. SSH) using certificates.”
   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “PIV (Personal Identity Verification)”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed6/10

   Feitian docs explicitly cover FIDO2 sk-ssh usage for OpenSSH/GitHub/Linux server login (feitian-docs-6) and PIV smart-card functionality including macOS PIV logon via SK Manager (feitian-docs-9, feitian-docs-10), supporting hardware-backed SSH auth with physical touch. However, no OpenPGP-based SSH key support is documented anywhere in the pack. Missing for 10: explicit OpenPGP applet/SSH support, independent/hands-on verification of sk-ssh workflow, and unified documentation tying all three methods together.

   • [claimed-docs] “Learn how to apply FEITIAN FIDO security keys with OpenSSH connections including remotely connecting Github and Linux server.”
   • [claimed-docs] “Learn how to use FEITIAN SK Manager tool to manager your security key 's functions including FIDO, PIV, OTP.”
   • [claimed-docs] “Learn how to use FEITIAN SK Manager to configure macOS PIV smart card log on.”

   proof ↗⚑ flag

Agent audit

1. ai-native userAn agent can read a key's state programmatically — serial, firmware version, enabled applications, stored credentials — to audit security posture across a fleet

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed5/10

   The official nitropy CLI (and Python SDK) can programmatically query device attributes such as version and connected devices (e.g., 'nitropy version', device listing), giving agents a scriptable way to pull serial/firmware info, and firmware update tooling is documented. However, there is no evidence of a documented way to enumerate 'enabled applications' or 'stored credentials' via CLI/API for fleet-wide security audits, and no fleet-management or structured (JSON/API) output is shown. Missing for 10: documented commands/output for enabled applications and stored credential enumeration, structured machine-readable output format, and any fleet-audit tooling or API/OpenAPI spec (probes show none exists).

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   There is a SK Manager GUI tool for managing FIDO/PIV/OTP functions, but no evidence of any programmatic API, CLI output, or SDK exposing serial, firmware version, enabled applications, or credential state for automated fleet auditing by an agent; probes for API/docs endpoints all returned 404.

   • [claimed-docs] “Learn how to use FEITIAN SK Manager tool to manager your security key 's functions including FIDO, PIV, OTP.”
   • [probe] “PROBE llms.txt: HTTP 404 at https://fido.ftsafe.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://fido.ftsafe.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://fido.ftsafe.com/openapi.json, https://fido.ftsafe.com/swagger.json, https://fido.ftsafe.com/…”

   proof ↗⚑ flag

Attestation

1. security engineerVerify device attestation at registration to enforce that only genuine, approved key models are enrolled

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity4/10

   Nitrokey ships FIDO2 (which includes device attestation) and PIV, but there is no documentation of an attestation verification workflow for registration, and a hands-on report notes attestation certificates can't be exported via standard PKCS#11 and require a custom vendor tool plus a non-standard ASN.1 cert format, adding real friction for engineers building attestation checks. missing for 10: first-party docs on attestation cert format/verification API, standard PKCS#11/FIDO2 attestation export support, independent confirmation of a smooth registration-time attestation check.

   • [claimed-docs] “SSH Keys”
   • [community] “I'm currently using both Nitrokeys and YubiHSMs on a client project. Nitrokeys can't do Ed25519, stuck with NSA Suite B for ECC. Attestation…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   No evidence in the pack discusses FIDO attestation, AAGUID verification, metadata service (MDS) support, or any mechanism for security engineers to validate genuine Feitian key models at registration; the docs cover general FIDO compatibility, interfaces, and setup guides only.

   ⚑ flag

Cli

1. developerConfigure and manage the key from an official CLI — enable applications, set PINs, manage slots, read device state — scriptably

   weight 3 · round to Nitrokey
   Nitrokey✓fullprobed8/10

   Nitrokey ships an official CLI, nitropy, documented at docs.nitrokey.com/software/nitropy and verified installable/runnable via PyPI, described as a tool to interact with Nitrokey devices (identity/version checks, firmware updates, etc.), plus a companion Python SDK — this covers scriptable device configuration and management. Missing for 10: explicit documentation/examples in the evidence pack of specific subcommands for PIN-setting, slot management, and app enable/disable, and independent hands-on confirmation of full feature parity across all device operations.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [claimed-docs] “Firmware Update”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed4/10

   Feitian offers GUI tools (SK Manager, iePassManager, OTP Tool) for managing FIDO/PIV/OTP functions, PINs, and slots, but these are graphical utilities, not documented as scriptable CLIs. No evidence of a command-line interface, scripting API, or automation-friendly tooling for enabling apps, setting PINs, or reading device state. missing for 10: dedicated CLI tool, scripting/automation documentation, examples of headless/scriptable configuration workflows.

   • [claimed-docs] “Learn how to use FEITIAN SK Manager tool to manager your security key 's functions including FIDO, PIV, OTP.”
   • [claimed-docs] “Learn how to use FEITIAN SK Manager to configure macOS PIV smart card log on.”
   • [claimed-docs] “Learn how to use iePassManager at Android OS to manage your FIDO devices(including FIDO PIN and credential related operations).”
   • [claimed-docs] “Learn how to use OTP Tool to switch protocol with FEITIAN FIDO security key.”

   proof ↗⚑ flag

Sdks

1. developerOfficial SDKs let me integrate the key into my own desktop and mobile apps

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed5/10

   Nitrokey provides nitropy CLI and a Python 'nitrokey' SDK on PyPI plus PIV/OpenPGP/PKCS#11 support that developers can integrate into tooling, but there is no evidence of official mobile SDKs (iOS/Android app libraries) or desktop app integration SDKs beyond the low-level Python/CLI tooling. missing for 10: dedicated mobile (iOS/Android) SDKs, higher-level desktop app integration libraries (e.g. for Electron/Swift/Java), first-party sample apps or API docs showing SDK usage in third-party apps.

   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [claimed-docs] “Android / NitroPhone”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   Evidence covers WebAuthn/FIDO2 standard support, OS integrations (Windows Hello, Azure AD, OpenSSH), and firmware provisioning via Google's OpenSK repo, but nothing indicates Feitian ships its own official SDK for developers to embed key support into custom desktop/mobile apps. Probe results also confirm no API/docs discoverability artifacts. This is an applicable axis for a hardware key vendor (SDKs are common in this space) but no evidence of one existing.

   • [claimed-docs] “Users can build firmware from the source code of Google OpenSK Github repository without changing anything, provision it to this OpenSK hard…”
   • [claimed-docs] “Users can build firmware from the source code of Google OpenSK Github repository without changing anything, provision it to this OpenSK hard…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://fido.ftsafe.com/openapi.json, https://fido.ftsafe.com/swagger.json, https://fido.ftsafe.com/…”

   proof ↗⚑ flag

Agent approval

1. ai-native userRequire a physical key touch as the human-approval step for sensitive automated or agent-initiated actions

   weight 1 · round to Feitian FIDO Keys
   Nitrokey—none0/10

   Nitrokey documents generic touch-confirmation for OpenPGP/FIDO2 operations, but there is no evidence tying this to AI-agent or automated-action approval workflows, MCP, or any agentic tooling — the capability as described in the story is unevidenced.

   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Two Factor Authentication”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed5/10

   Feitian keys are standard FIDO2/WebAuthn/U2F hardware tokens that inherently require a physical touch to complete authentication (feitian-docs-1, feitian-docs-4, feitian-docs-18), which is the underlying mechanism that could be wired into an agent's approval flow via WebAuthn. However, there is no evidence of any AI-agent-specific integration, SDK, or documented workflow showing the key used as a human-approval gate for agent-initiated actions. Missing for 10: explicit AI-agent/automation integration examples, documentation of using the key as an approval gate in agentic pipelines, and any third-party corroboration of this use case.

   • [claimed-docs] “Fully compatible to W3C's Web Authentication Standard with HID interface. Plug in and secure your web applications easily.”
   • [claimed-docs] “USB, NFC, and BLE, MultiPass FIDO® Security Key employs three communication interfaces.”
   • [claimed-docs] “USB, NFC, and BLE, MultiPass FIDO® Security Key employs three communication interfaces. Users can use any of these interfaces to complete FI…”

   proof ↗⚑ flag

Compatibility

1. power userThe key works across my operating systems and browsers, with a published compatibility catalog of supported services

   weight 2 · round to Feitian FIDO Keys
   Nitrokey!disputedcontradicted4/10

   Docs scatter claims of broad compatibility (SSH, FIDO2, OTP, PIV, OpenPGP, Windows/AD, Office 365, Nextcloud, Thunderbird, OpenVPN) but there is no single published compatibility catalog/matrix of supported services or browsers. Community evidence concretely contradicts smooth cross-platform delivery: users report needing to allow unsigned driver installation on Windows, and multiple reports that Nitrokey 3 still lists many features as 'planned' and lags Yubikey in feature parity years after purchase. missing for 10: a unified compatibility matrix/catalog page, confirmation of parity across all claimed services, resolution of the Windows driver-signing friction.

   • [claimed-docs] “Login to websites (e.g. Google, Facebook) using secure One Time Passwords (OTP), U2F or ordinary static passwords.”
   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [community] “To install the driver, you may need to allow the installation of unsigned drivers first. Nope, thanks.”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed5/10

   Feitian documents cross-platform compatibility (Windows, macOS, Linux, Android/iOS) and integration guides for specific platforms (Windows Hello, Azure AD, GitHub/OpenSSH, Google Advanced Protection, PIV/macOS), and multi-interface support (USB/NFC/BLE) which implies broad OS/browser reach. However there is no published, centralized compatibility catalog or matrix listing supported browsers/services, and no independent verification of claims. Missing for 10: a formal published compatibility catalog/matrix of supported services and browsers, independent/hands-on verification of cross-platform claims.

   • [claimed-docs] “Fully compatible to W3C's Web Authentication Standard with HID interface. Plug in and secure your web applications easily.”
   • [claimed-docs] “Seamlessly support Windows Hello (Within an Azure AD).”
   • [claimed-docs] “Learn how to apply FEITIAN FIDO security keys with OpenSSH connections including remotely connecting Github and Linux server.”
   • [claimed-docs] “Learn how to use your FEITIAN FIDO2 security key to protect your Azure AD joined Windows 10.”
   • [claimed-docs] “Learn how to use FEITIAN SK Manager to configure macOS PIV smart card log on.”
   • [claimed-docs] “MultiPass FIDO® Security Key is also compatible with any Android / iOS platforms with Bluetooth v4.0+.”
   • [claimed-docs] “Recognized as a HID device, no driver is needed for MultiPass FIDO® Security Key to work on Microsoft Windows, macOS and Linux via USB.”
   • [claimed-docs] “Introduction about how FEITIAN Security Keys works with Google advanced protection.”

   proof ↗⚑ flag

Recovery

1. security engineerThe vendor documents a credible lockout-recovery strategy — registering a backup key, and what is and is not recoverable if a key is lost

   weight 3 · round to Feitian FIDO Keys
   Nitrokey—none0/10

   No evidence pack item documents a vendor-provided lockout-recovery strategy (e.g., registering a backup Nitrokey, or what OpenPGP/FIDO2/PIV credentials are or are not recoverable if a key is lost). The closest mention is a third-party community comment about offline key escrow for the unrelated HSM product, not official documentation of recovery/backup-key enrollment.

   • [community] “Used the original Nitrokey HSM model on a code-signing server project. The applet running inside is not free/open source but dev tools and d…”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed5/10

   FAQ entries state that a lost key can be worked around by logging in with a backup security key or another method, then disabling the lost key and provisioning a new one, which is a real but minimal statement of a lockout-recovery strategy (feitian-docs-14, feitian-docs-24). However, there is no dedicated recovery guide explaining what is and isn't recoverable (e.g., per-relying-party re-registration necessity, loss of resident/discoverable credentials, biometric enrollment data) beyond this brief FAQ mention. Missing for 10: a structured recovery/lockout doc, explicit treatment of what is NOT recoverable (credentials tied to lost key), and guidance on enrolling multiple backup keys per service rather than just a generic FAQ answer.

   • [claimed-docs] “The dedicated users can still logon to the account by using back-up security key or other method.”
   • [claimed-docs] “The dedicated users can still logon to the account by using back-up security key or other method. Then user can disable the lost security ke…”

   proof ↗⚑ flag

Setup

1. power userFirst-time setup is guided — clear instructions or a setup app walk me through registering the key with my accounts

   weight 2 · round to Feitian FIDO Keys
   Nitrokey~partialprobed5/10

   Nitrokey provides scattered feature-specific docs (SSH, PIV, OpenPGP, FIDO2, general instructions) and a CLI tool (nitropy) for device management, which can guide account registration for specific services, but there's no single unified setup wizard/app walking a user end-to-end through registering with major accounts. Community feedback also flags real setup friction (e.g., needing to allow unsigned driver installation) that undercuts a smooth guided experience. Missing for 10: a dedicated onboarding app/wizard, first-party account-registration walkthroughs (e.g., for Google/Microsoft/GitHub), and independent hands-on confirmation that setup is smooth.

   • [claimed-docs] “Two Factor Authentication”
   • [claimed-docs] “General Instructions”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [community] “To install the driver, you may need to allow the installation of unsigned drivers first. Nope, thanks.”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed7/10

   Feitian provides first-party guided documentation for pairing keys (BLE setup guide), registering with specific platforms (Windows, Azure AD, Microsoft, GitHub/Linux via OpenSSH), and a dedicated SK Manager desktop app for configuring FIDO/PIV/OTP functions, which together resemble a guided enrollment flow for a power user. However, missing for 10: independent/hands-on user reports confirming the setup experience is clear in practice, and no single unified 'wizard' walkthrough spanning consumer-account registration (e.g., Google/Microsoft account UI) rather than platform/OS-level docs.

   • [claimed-docs] “Learn how to pair your FEITIAN Bluetooth FIDO2 security key to your device.”
   • [claimed-docs] “Learn how to apply FEITIAN FIDO security keys with OpenSSH connections including remotely connecting Github and Linux server.”
   • [claimed-docs] “Learn how to use your FEITIAN FIDO2 security key to protect your personal Windows.”
   • [claimed-docs] “Learn how to use your FEITIAN FIDO2 security key to protect your Azure AD joined Windows 10.”
   • [claimed-docs] “Learn how to use FEITIAN SK Manager tool to manager your security key 's functions including FIDO, PIV, OTP.”
   • [claimed-docs] “Learn how to use your FEITIAN FIDO2 security key to protect your Microsoft application.”

   proof ↗⚑ flag

Source

1. security engineerThe firmware is open source or independently audited, so I don't have to take the vendor's word for what runs on the device

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed7/10

   Nitrokey 3 firmware is confirmed open source (Rust, dual Apache2.0/MIT licensed, tagged releases on GitHub) which lets engineers inspect what runs on the device, but the HSM applet is explicitly noted as not open source, and there is no evidence of an independent third-party security audit of the firmware. missing for 10: independent audit report, confirmation that all product lines (not just Nitrokey 3) are open source, no audit mention for the closed HSM applet.

   • [github] “This software is fully open source.”
   • [github] “The Nitrokey 3 firmware is written in Rust. It uses the Trussed firmware framework and is developed in collaboration with SoloKeys”
   • [github] “All software, unless otherwise noted, is dual licensed under Apache 2.0 and MIT license.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey 3 firmware is open source in Rust WITH tagged, installable releases — https://github.com/Nitro…”
   • [community] “Used the original Nitrokey HSM model on a code-signing server project. The applet running inside is not free/open source but dev tools and d…”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed5/10

   Feitian offers a specific OpenSK hardware variant where users can build firmware from Google's open-source OpenSK repo and flash it themselves, directly addressing the transparency concern for that model. However, the flagship BioPass and MultiPass FIDO keys firmware is not documented as open source or independently audited, and no third-party security audit reports are cited anywhere in the pack. missing for 10: independent firmware audit reports for mainstream product lines, confirmation that BioPass and MultiPass firmware not just the niche OpenSK SKU is open or audited, and hands-on verification that shipped OpenSK devices match the public source

   • [claimed-docs] “Users can build firmware from the source code of Google OpenSK Github repository without changing anything, provision it to this OpenSK hard…”
   • [claimed-docs] “Users can build firmware from the source code of Google OpenSK Github repository without changing anything, provision it to this OpenSK hard…”

   proof ↗⚑ flag

Updates

1. security engineerThe vendor has a clear firmware update and vulnerability-response story — advisories, affected-model lookup, and how fixes reach devices

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed4/10

   Nitrokey documents a firmware-update mechanism (dedicated firmware-update guide, nitropy CLI, tagged GitHub releases like v1.8.3) and open-source firmware for transparency, but there is no evidence of a formal security-advisory feed, CVE list, or affected-model lookup tool comparable to a vendor security bulletin process; a community post references a real key-extraction issue discussed ad hoc rather than via a documented advisory pipeline. Missing for 10: dedicated security advisories page, CVE/vulnerability database, affected-model/version lookup tool, and clear SLA for how fixes reach devices beyond generic update docs.

   • [claimed-docs] “Firmware Update”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey 3 firmware is open source in Rust WITH tagged, installable releases — https://github.com/Nitro…”
   • [community] “Author here: extracting Nitrokey HSM RSA private keys is not a vulnerability per se - it requires the attacker to already have the keys to t…”
   • [github] “This software is fully open source.”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   No evidence of security advisories, CVE tracking, affected-model lookup tools, or a documented firmware update delivery mechanism; only general product/setup docs and an OpenSK build guide are present, none of which address vulnerability response or patch distribution.

   ⚑ flag

Agent provisioning

1. ai-native userAn agent can drive key provisioning end to end — ordering, assignment, pre-registration — through documented enterprise APIs instead of a human-only console

   weight 2 · round drawn
   Nitrokey—none0/10

   Nitrokey documents an nitropy CLI for on-device configuration and an Entra ID provisioning integration, but there is no evidence of a documented enterprise API supporting agent-driven ordering, assignment, or pre-registration workflows — OpenAPI/API probes all returned 404. missing for 10: documented REST/enterprise API for ordering and fleet assignment, evidence of programmatic pre-registration, any API reference beyond CLI tooling.

   • [claimed-docs] “Nitrokey Provisioning for Entra ID”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   No evidence of any enterprise API for provisioning, ordering, or assignment of keys — all documentation is consumer/end-user setup guides, and probes for API/docs endpoints returned 404s.

   • [probe] “PROBE llms.txt: HTTP 404 at https://fido.ftsafe.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://fido.ftsafe.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://fido.ftsafe.com/openapi.json, https://fido.ftsafe.com/swagger.json, https://fido.ftsafe.com/…”

   proof ↗⚑ flag

Delivery

1. it adminAn enterprise delivery service ships keys directly to distributed employees, driven by an API or console rather than manual logistics

   weight 2 · round drawn
   Nitrokey—none0/10

   Evidence covers device features (FIDO2, OpenPGP, PIV), firmware/CLI tooling, and community feedback on hardware/support quality, but nothing addresses enterprise bulk-shipping/fleet logistics, an API/console for distributing keys directly to distributed employees, or any provisioning-and-delivery service comparable to fleet-management logistics.

   ⚑ flag

   Feitian FIDO Keys—none0/10

   No evidence of any API, console, or enterprise fulfillment/logistics/shipping-management capability; probes confirm no API/docs exist for this. Evidence covers only device features (FIDO2, biometrics, NFC/BLE/USB) and setup guides, nothing about distributed shipping orchestration.

   • [probe] “PROBE llms.txt: HTTP 404 at https://fido.ftsafe.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://fido.ftsafe.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://fido.ftsafe.com/openapi.json, https://fido.ftsafe.com/swagger.json, https://fido.ftsafe.com/…”

   proof ↗⚑ flag

Idp

1. it adminThe key integrates with my identity provider — Okta, Entra ID, Google Workspace — and I can enforce policies requiring hardware-key authentication

   weight 2 · round to Feitian FIDO Keys
   Nitrokey~partialclaimed4/10

   Nitrokey documents FIDO2/PIV/OpenPGP protocol support and a specific 'Nitrokey Provisioning for Entra ID' tool, showing some IdP integration, but there is no evidence of Okta or Google Workspace integration, nor any admin console/policy engine to enforce hardware-key-only authentication fleet-wide. Missing for 10: Okta integration, Google Workspace integration, centralized policy enforcement/fleet management console, documentation of admin-side enrollment/compliance workflows.

   • [claimed-docs] “Nitrokey Provisioning for Entra ID”
   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [claimed-docs] “PIV (Personal Identity Verification)”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed6/10

   Feitian keys are documented as fully W3C WebAuthn/FIDO2-compliant HID devices with explicit setup guides for Azure AD-joined Windows, Microsoft applications, and Google Advanced Protection, which implies interoperability with major identity providers. However, there is no explicit documentation or guide for Okta or Google Workspace integration, nor any mention of admin-side policy enforcement (e.g., requiring hardware-key-only auth) within these IdPs. Missing for 10: Okta-specific integration guide, Google Workspace-specific setup docs, and evidence of IdP admin policy controls enforcing hardware-key requirements.

   • [claimed-docs] “Fully compatible to W3C's Web Authentication Standard with HID interface. Plug in and secure your web applications easily.”
   • [claimed-docs] “Learn how to use your FEITIAN FIDO2 security key to protect your Azure AD joined Windows 10.”
   • [claimed-docs] “Learn how to use your FEITIAN FIDO2 security key to protect your Microsoft application.”
   • [claimed-docs] “Introduction about how FEITIAN Security Keys works with Google advanced protection.”
   • [claimed-docs] “Seamlessly support Windows Hello (Within an Azure AD).”

   proof ↗⚑ flag

Provisioning

1. it adminProvision keys across an organization at scale — pre-registration, bulk configuration, and lifecycle tracking of issued keys

   weight 3 · round to Nitrokey
   Nitrokey~partialprobed3/10

   Nitrokey ships an official CLI (nitropy) and Python SDK for scripting device operations, and docs reference 'Nitrokey Provisioning for Entra ID,' suggesting some enterprise provisioning path exists, but there is no evidence of bulk pre-registration workflows, centralized fleet dashboards, or lifecycle/audit tracking across many issued keys. missing for 10: bulk enrollment/pre-registration tooling, centralized admin console for fleet inventory, lifecycle/revocation tracking at scale, independent case studies of large deployments.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [claimed-docs] “Nitrokey Provisioning for Entra ID”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   Evidence only shows per-device configuration tools (SK Manager, iePassManager) for individual FIDO/PIV/OTP settings, not organization-wide bulk provisioning, pre-registration workflows, or lifecycle/inventory tracking across a fleet of keys. No admin console, CSV/bulk import, or enterprise deployment tooling is documented.

   • [claimed-docs] “Learn how to use FEITIAN SK Manager tool to manager your security key 's functions including FIDO, PIV, OTP.”
   • [claimed-docs] “Learn how to use FEITIAN SK Manager to configure macOS PIV smart card log on.”
   • [claimed-docs] “Learn how to use iePassManager at Android OS to manage your FIDO devices(including FIDO PIN and credential related operations).”
   • [claimed-docs] “Learn how to use OTP Tool to switch protocol with FEITIAN FIDO security key.”

   proof ↗⚑ flag

Certifications

1. it adminCertified models exist for regulated environments — FIPS 140 validated or Common Criteria certified — with documented durability (water/crush resistance)

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity3/10

   Nitrokey documents a Common Criteria EAL 6+ certified secure element in the Nitrokey 3 (nitrokey-docs-16), satisfying the certification half of the story, but there is no mention anywhere in the evidence of FIPS 140 validation, nor any documented water/crush-resistance or ruggedization specs. Community hands-on feedback actively undercuts the durability angle, describing the U2F key as feeling 'flimsy' compared to competitors (nitrokey-comm-3, nitrokey-comm-4). Missing for 10: FIPS 140 validation evidence, explicit IP/MIL-STD or water/crush durability specs, and independent corroboration of ruggedness rather than community complaints about build quality.

   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [community] “I wish they would make something that felt more durable. I bought the U2F key and the combination of plastic and not being sure where to pre…”
   • [community] “Unlike some competitors, Nitrokey contains a complete and standard compliant USB plug... Here I am waiting for a Type-C from them. Yet they …”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   The evidence pack contains no mention of FIPS 140 validation, Common Criteria certification, or durability testing (water/crush resistance) for any Feitian key; all citations focus on protocol compatibility, interfaces, and setup guides. Missing for 10: FIPS 140 validation documentation, Common Criteria certification documentation, water/crush resistance durability specs.

   ⚑ flag

Connectors

1. power userThe lineup covers my ports and carry style — USB-C and USB-A models, keychain and low-profile nano form factors

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity4/10

   Evidence indirectly shows both USB-A and USB-C variants exist (the shop page references 'nk3an-nitrokey-3a-nfc' and a community comment mentions ordering a 'Nitrokey 3C NFC'), suggesting the lineup covers both port types. However, there is no evidence of keychain or nano low-profile form factors anywhere in the pack, and one community comment even complains about waiting years for a Type-C model, casting some doubt on breadth/availability. Missing for 10: explicit nano/keychain form-factor SKUs, confirmed current availability of USB-C models, first-party spec sheet comparing form factors.

   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [community] “Unlike some competitors, Nitrokey contains a complete and standard compliant USB plug... Here I am waiting for a Type-C from them. Yet they …”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   The evidence pack covers interfaces (USB/NFC/BLE), biometric and OpenSK products, but never mentions specific form factors like USB-C vs USB-A connectors, keychain design, or nano/low-profile sizing — no product lineup breakdown by physical form is shown.

   ⚑ flag

Nfc

1. power userTap the key on my phone over NFC to authenticate in mobile browsers and apps

   weight 2 · round to Feitian FIDO Keys
   Nitrokey~partialclaimed4/10

   Nitrokey sells an NFC-enabled model (Nitrokey 3A NFC) and documents FIDO2/U2F/OTP login flows and an Android/NitroPhone integration, implying NFC tap-to-auth is technically supported, but no evidence explicitly confirms tapping the key against a phone to authenticate in mobile browsers/apps, nor any hands-on report of this working. Missing for 10: explicit documentation or user testimony of NFC-based authentication on phones, coverage across major mobile browsers/apps, and confirmation it works as smoothly as competitors.

   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [claimed-docs] “Android / NitroPhone”
   • [claimed-docs] “Two Factor Authentication”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed6/10

   MultiPass FIDO Security Key explicitly supports NFC as one of three interfaces and is documented compatible with Android/iOS platforms, implying tap-to-authenticate via NFC on mobile; however, evidence doesn't explicitly confirm NFC (vs BLE) works with specific mobile browsers/apps or provide hands-on confirmation. missing for 10: explicit mobile browser/app NFC tap walkthrough, independent hands-on verification of NFC mobile authentication.

   • [claimed-docs] “USB, NFC, and BLE, MultiPass FIDO® Security Key employs three communication interfaces.”
   • [claimed-docs] “USB, NFC, and BLE, MultiPass FIDO® Security Key employs three communication interfaces. Users can use any of these interfaces to complete FI…”
   • [claimed-docs] “MultiPass FIDO® Security Key is also compatible with any Android / iOS platforms with Bluetooth v4.0+.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed4/10

   Nitrokey ships an official CLI (nitropy) and Python SDK that can configure/manage devices programmatically, confirmed to install and run via PyPI, but there is no formal REST/OpenAPI interface (all API endpoint probes 404) and no explicit vendor claim of full UI/CLI feature parity for AI-native automation. Missing for 10: documented API/OpenAPI spec, explicit parity statement between GUI app and nitropy CLI, and independent verification that all UI-exposed features are scriptable via nitropy.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Nitrokey
   Nitrokey!disputedcontradicted3/10

   Nitrokey's firmware and licensing are open source (nitrokey-gh-1, nitrokey-gh-3) and it uses open standards like FIDO2/OpenPGP/PIV, which in principle avoid lock-in, but a hands-on user report describes the opposite of clean data portability: Nitrokey attestation certs 'can't be exported via PKCS#11' and require a 'custom vendor shell' with a non-standard ASN.1 cert container (nitrokey-comm-2) — directly contradicting an open, portable data-export claim. Missing for 10: any first-party documentation of a bulk/data export feature or standard export format for stored secrets, and no counter-evidence resolving the community-reported non-standard export path.

   • [github] “This software is fully open source.”
   • [github] “All software, unless otherwise noted, is dual licensed under Apache 2.0 and MIT license.”
   • [community] “I'm currently using both Nitrokeys and YubiHSMs on a client project. Nitrokeys can't do Ed25519, stuck with NSA Suite B for ECC. Attestation…”

   proof ↗⚑ flag

   Feitian FIDO Keys—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to Nitrokey
   Nitrokey✓fullprobed8/10

   Nitrokey 3 firmware source is hosted on GitHub, explicitly stated to be fully open source, dual-licensed under Apache 2.0/MIT, with tagged releases confirming active open development. This directly satisfies reading source under an open license for the core firmware. Missing for 10: confirmation that all components (e.g., HSM applet, some proprietary parts noted in community evidence) are open, and no independent audit of license completeness beyond firmware repo.

   • [github] “This software is fully open source.”
   • [github] “The Nitrokey 3 firmware is written in Rust. It uses the Trussed firmware framework and is developed in collaboration with SoloKeys”
   • [github] “All software, unless otherwise noted, is dual licensed under Apache 2.0 and MIT license.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey 3 firmware is open source in Rust WITH tagged, installable releases — https://github.com/Nitro…”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed4/10

   Feitian ships a specific 'OpenSK' hardware variant that can run firmware built from Google's open-source OpenSK repository, giving some access to readable/open-licensed source for that SKU, but this is a third-party (Google) codebase, not Feitian's own firmware for its mainstream BioPass/MultiPass keys, which remain closed. Missing for 10: evidence that Feitian's own primary product firmware/source is published under an open license, and no indication of a public source repo, license file, or docs-as-markdown/API spec for the broader product line.

   • [claimed-docs] “Users can build firmware from the source code of Google OpenSK Github repository without changing anything, provision it to this OpenSK hard…”
   • [claimed-docs] “Users can build firmware from the source code of Google OpenSK Github repository without changing anything, provision it to this OpenSK hard…”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to Feitian FIDO Keys
   Nitrokey—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Feitian FIDO Keys~partialclaimed5/10

   The FIDO key is inherently a local, on-device hardware authenticator (not a hosted service), and Feitian explicitly documents that users can build firmware from Google's open-source OpenSK repository and provision it onto the hardware themselves, giving genuine control over the 'core product' without vendor cloud dependency. This is a reasonable analog to self-hosting for a hardware device, but it's not a full self-hostable software stack with deployment docs, and there's no evidence of self-hosted backend/server components (e.g., FIDO server, attestation service) that would round out a complete self-hosting story. Missing for 10: documentation of self-hosting any server-side/relying-party components, deployment guides beyond firmware flashing, and independent confirmation of OpenSK build success.

   • [claimed-docs] “Users can build firmware from the source code of Google OpenSK Github repository without changing anything, provision it to this OpenSK hard…”
   • [claimed-docs] “Users can build firmware from the source code of Google OpenSK Github repository without changing anything, provision it to this OpenSK hard…”

   proof ↗⚑ flag

1. ai-native userControl data retention and deletion

   weight 2 · round drawn
   Nitrokey—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Feitian FIDO Keys—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

2. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   Nitrokey—none0/10

   The evidence pack covers Nitrokey's hardware features (FIDO2, OpenPGP, PIV), its open-source firmware/CLI (nitropy), and community commentary on durability/support, but contains no mention of any telemetry, usage tracking, or opt-out settings for its software (nitropy CLI, firmware update service) or hardware. Since Nitrokey ships software tools that could in principle collect usage data, the axis applies, but there is no evidence either confirming or denying telemetry practices.

   ⚑ flag

   Feitian FIDO Keys—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Credential management

1. power userList and delete the passkeys stored on my key and know its credential capacity before it fills up

   weight 2 · round to Feitian FIDO Keys
   Nitrokey—none0/10

   While Nitrokey ships FIDO2 support and an official nitropy CLI, the evidence pack contains no documentation or mention of commands/features to list resident passkeys, delete individual credentials, or view credential storage capacity/limits. This is a fair capability to expect from a FIDO2 authenticator, but no evidence confirms it.

   ⚑ flag

   Feitian FIDO Keys~partialclaimed4/10

   FEITIAN provides tools (SK Manager, iePassManager) described as managing 'FIDO PIN and credential related operations' on the key, implying some list/delete capability, and one product page claims 'no limit to accounts' for the MultiPass key. However, there is no explicit documentation of a list/delete-passkey UI, no discussion of credential capacity limits for other models, and no guidance on capacity awareness before a key fills up. missing for 10: explicit list/delete UI screenshots or steps, documented per-model credential capacity limits, and warnings/behavior when storage is full.

   • [claimed-docs] “Learn how to use FEITIAN SK Manager tool to manager your security key 's functions including FIDO, PIV, OTP.”
   • [claimed-docs] “Learn how to use iePassManager at Android OS to manage your FIDO devices(including FIDO PIN and credential related operations).”
   • [claimed-docs] “There is no limit to the number of accounts registered in MultiPass FIDO® Security Key.”

   proof ↗⚑ flag

Fido2

1. security engineerThe key stores discoverable FIDO2 credentials (resident keys / device-bound passkeys) so users can sign in to WebAuthn services without typing a username

   weight 3 · round to Nitrokey
   Nitrokey~partialcommunity6/10

   Docs confirm FIDO2 support and explicitly market 'passwordless login' to Microsoft/Nextcloud (nitrokey-docs-4), which implies discoverable/resident-key credentials, and FIDO2 is listed as a core feature (nitrokey-docs-1, nitrokey-docs-16). However, no documentation explicitly names 'resident keys' or 'discoverable credentials,' and community reports note the Nitrokey 3 has lagged on FIDO2 feature parity with competitors (many features listed as 'planned'), raising doubt about completeness. Missing for 10: explicit resident-key/discoverable-credential documentation, independent hands-on verification of usernameless sign-in working end-to-end.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed5/10

   Feitian's keys are explicitly W3C WebAuthn/FIDO2 compliant and marketed for passwordless sign-in scenarios like Windows Hello and Google Advanced Protection, which typically rely on discoverable credentials, but the evidence never explicitly names 'resident keys' or 'discoverable credentials' or confirms a specific stored-credential capacity/no-username login flow. Missing for 10: explicit documentation of resident-key/discoverable-credential support, stated credential storage limits, and a hands-on demonstration of username-less WebAuthn sign-in.

   • [claimed-docs] “Fully compatible to W3C's Web Authentication Standard with HID interface. Plug in and secure your web applications easily.”
   • [claimed-docs] “Seamlessly support Windows Hello (Within an Azure AD).”
   • [claimed-docs] “Introduction about how FEITIAN Security Keys works with Google advanced protection.”
   • [claimed-docs] “Users can build firmware from the source code of Google OpenSK Github repository without changing anything, provision it to this OpenSK hard…”

   proof ↗⚑ flag

2. power userThe key works as a WebAuthn/U2F second factor across the major services I already use — Google, GitHub, Microsoft, password managers

   weight 2 · round to Feitian FIDO Keys
   Nitrokey~partialcommunity6/10

   Docs confirm FIDO2/U2F support and explicitly name Google/Facebook U2F login and Microsoft passwordless login, and general 'Two Factor Authentication' docs exist, but GitHub and password-manager compatibility are never explicitly evidenced. Community reports also note the Nitrokey 3 lagging in feature parity vs. competitors and having 'planned' rather than shipped features, raising some doubt about full protocol coverage. Missing for 10: explicit GitHub WebAuthn/U2F confirmation, password-manager (e.g. Bitwarden/1Password) compatibility evidence, and independent hands-on confirmation across these specific services.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Login to websites (e.g. Google, Facebook) using secure One Time Passwords (OTP), U2F or ordinary static passwords.”
   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “Two Factor Authentication”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   Feitian FIDO Keys~partialclaimed7/10

   First-party docs confirm W3C WebAuthn/U2F compliance and dedicated guides for GitHub (OpenSSH), Microsoft/Azure AD, and Google Advanced Protection, showing broad cross-service compatibility. Missing for 10: explicit password-manager (e.g., 1Password/Bitwarden) integration guidance and independent/hands-on verification beyond vendor documentation.

   • [claimed-docs] “Fully compatible to W3C's Web Authentication Standard with HID interface. Plug in and secure your web applications easily.”
   • [claimed-docs] “Learn how to apply FEITIAN FIDO security keys with OpenSSH connections including remotely connecting Github and Linux server.”
   • [claimed-docs] “Learn how to use your FEITIAN FIDO2 security key to protect your Azure AD joined Windows 10.”
   • [claimed-docs] “Learn how to use your FEITIAN FIDO2 security key to protect your Microsoft application.”
   • [claimed-docs] “Introduction about how FEITIAN Security Keys works with Google advanced protection.”

   proof ↗⚑ flag

User verification

1. security engineerThe key supports on-device user verification — a FIDO2 PIN or built-in biometric — so a stolen key alone cannot authenticate

   weight 2 · round to Feitian FIDO Keys
   Nitrokey—none0/10

   Evidence confirms Nitrokey devices support FIDO2 and mentions 'Touch Confirmation' (a presence check), but nowhere does it document a FIDO2 PIN or biometric on-device user-verification mechanism that would block use by a mere possessor of a stolen key. Missing for 10: explicit documentation of FIDO2 PIN setup/enforcement, biometric sensor support, or any UV (user verification) flag being satisfied — only touch/presence confirmation is evidenced, which is a different, weaker security property.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”

   proof ↗⚑ flag

   Feitian FIDO Keys✓fullclaimed7/10

   Feitian documents biometric (fingerprint) on-device user verification for BioPass keys, explicitly noting 'losing the key will cause no security risk at all,' and separately documents FIDO PIN management via iePassManager for PIN/credential operations, satisfying the on-device UV requirement. Missing for 10: independent/hands-on verification of PIN enforcement or biometric FAR/FRR, and no explicit CTAP2 'uv' flag documentation.

   • [claimed-docs] “Biometric technology makes BioPass FIDO2 Security Key one of the most secure tokens.”
   • [claimed-docs] “The fingerprint module prevents any misuses of the token from people other than authorized user, and losing the key will cause no security r…”
   • [claimed-docs] “Learn how to use iePassManager at Android OS to manage your FIDO devices(including FIDO PIN and credential related operations).”
   • [claimed-docs] “Learn how to use FEITIAN SK Manager tool to manager your security key 's functions including FIDO, PIV, OTP.”

   proof ↗⚑ flag