Nitrokey vs SoloKeys Solo 2

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round drawn
   Nitrokey—none0/10

   Probes explicitly confirm no llms.txt or agent-oriented docs endpoint exists (404s), and no evidence of AI-native documentation is present anywhere in the pack.

   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://docs.nitrokey.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   Explicit probes confirm docs.solokeys.dev has no llms.txt (404) and no openapi/markdown-alternative endpoints; the only llms.txt found is a generic Shopify shopping-agent file unrelated to technical/product documentation, so there is no agent-oriented documentation to point an AI agent at.

   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.solokeys.dev/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://docs.solokeys.dev/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.solokeys.dev/openapi.json, https://docs.solokeys.dev/swagger.json, https://docs.solokey…”
   • [probe] “PROBE runtime (recorded 2026-09-15): solokeys.com serves an llms.txt ('# Agent Instructions — SoloKeys'), but it is Shopify's platform-gener…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed4/10

   Nitrokey ships an official CLI (nitropy) that installs headlessly via pip/uvx and can be scripted, which is the closest evidence to CI-style automation (nitrokey-docs-14, nitrokey-probe-4, nitrokey-probe-rt-1). However, there is no documentation of CI pipelines, headless authentication flows, or automation guides, and the core use cases (FIDO2/OTP/PGP) inherently require physical touch presence, limiting true headless operation. Missing for 10: explicit CI/automation documentation, examples of nitropy used in pipelines, and clarification on how touch-required operations are handled headlessly.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   Solo 2 is a physical security key requiring human touch confirmation for every action, and while a CLI exists (solo2 list, admin commands), there's no documented support for headless/CI automation; a runtime probe shows the official CLI is bit-rotted (ImportError, incompatible fido2 dependency) with no firmware release in 4 years, further undermining any automation use case.

   • [claimed-docs] “When prompted, touch the capacitive sensor on your Solo 2 to confirm.”
   • [github] “solo2 list # list connected devices (alias: solo2 ls)”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

3. ai-native userUse an official CLI

   weight 2 · round to Nitrokey
   Nitrokey✓fullprobed8/10

   Nitrokey ships an official, actively maintained CLI (nitropy) documented at docs.nitrokey.com and verified at runtime to install cleanly via PyPI/uvx and report its version, confirming it works as claimed for scripting/automation-style interaction with the device. Missing for 10: no evidence of AI-agent-specific integration, tool-calling support, or third-party corroboration of the CLI's use in agentic workflows.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   SoloKeys Solo 2!disputedcontradicted3/10

   GitHub docs show an official `solo2` CLI with scriptable commands (list, admin set led, monitor, wipe) suitable for automation, but a runtime probe found the official Solo CLI (solo-python) actually fails to run due to a dependency ImportError, and no Solo 2 firmware release has shipped in 4 years despite ongoing CI commits — concretely contradicting the claim of a working, maintained official CLI. Missing for 10: evidence of AI-agent-specific CLI usage/documentation, confirmation the solo2 (Rust) CLI itself runs cleanly, and independent corroboration beyond the vendor's own repo.

   • [github] “solo2 app admin set led 007f7f 00007f # set led to teal (idle) / blue (active) - use 000000 to turn the led off”
   • [github] “solo2 list # list connected devices (alias: solo2 ls)”
   • [claimed-docs] “solo monitor <serial-port>”
   • [claimed-docs] “You can "wipe" a device using `fido2-token -R`”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

4. ai-native userDrive the product through a documented public API

   weight 3 · round to Nitrokey
   Nitrokey~partialprobed5/10

   Nitrokey ships a documented CLI/SDK (nitropy, pynitrokey) that lets scripts/agents drive the hardware token programmatically, confirmed by runtime probes showing it installs and runs from PyPI. However, there is no REST/OpenAPI-style public API — explicit probes for llms.txt, docs-md, and openapi.json all 404 — so an AI agent has no network-callable documented API, only a local CLI/SDK. Missing for 10: a documented HTTP/OpenAPI public API, machine-readable API spec, and any AI-agent-specific integration guidance.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://docs.nitrokey.com/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   Solo 2 exposes a hardware CLI (solo2 app/list) and standard protocols like FIDO2/PIV/OpenPGP, but there is no documented public REST/programmatic API for AI-driven control, and probes confirm no OpenAPI spec or llms.txt exists (404s) while the closest thing to an SDK (solo-python CLI) is reported bit-rotted and broken via ImportError. No evidence of a working, documented API surface an AI agent could drive.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.solokeys.dev/openapi.json, https://docs.solokeys.dev/swagger.json, https://docs.solokey…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.solokeys.dev/llms.txt”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”
   • [probe] “PROBE runtime (recorded 2026-09-15): solokeys.com serves an llms.txt ('# Agent Instructions — SoloKeys'), but it is Shopify's platform-gener…”

   proof ↗⚑ flag

5. ai-native userBuild against official SDKs

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed6/10

   Nitrokey publishes an official CLI (nitropy) and a Python SDK (pynitrokey) on PyPI, both confirmed working via runtime probes, and firmware/source are open on GitHub — giving developers a real path to build against official tooling. However there's no evidence of broader multi-language SDKs, API references beyond nitropy, or any AI/agent-specific integration surface (no OpenAPI, no llms.txt, probes for both 404). Missing for 10: multi-language/official SDKs beyond Python, formal API docs/OpenAPI spec, AI-agent-specific integration examples.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [github] “The Nitrokey 3 firmware is written in Rust. It uses the Trussed firmware framework and is developed in collaboration with SoloKeys”
   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.nitrokey.com/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   Evidence shows firmware-build tooling (Rust/cargo builds, solo2 CLI, customization docs) rather than an official SDK for third-party/AI-native application development, and the one CLI tool cited is reported bit-rotted and broken in 2026 (ImportError, no releases in 4 years). No client library, API reference, or SDK package is documented for developers to build against.

   • [claimed-docs] “To build, develop and debug the firmware for the STM32L432.”
   • [claimed-docs] “rustup target install thumbv8m.main-none-eabi cargo install flip-link cargo install cargo-binutils cargo install probe-rs-tools”
   • [github] “On a **Hacker** key you can build and flash your own firmware.”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.solokeys.dev/openapi.json, https://docs.solokeys.dev/swagger.json, https://docs.solokey…”

   proof ↗⚑ flag

Api quality

1. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   Nitrokey—none0/10

   Nitrokey is a hardware security key vendor; the probe explicitly checked for a machine-readable API spec (openapi.json, swagger.json, etc.) and all candidates returned 404, with no OpenAPI/Swagger spec documented anywhere in the evidence pack.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   SoloKeys is a hardware security key with a CLI and firmware documentation, not an API/web service; a machine-readable OpenAPI spec would be a fair thing to ask for if it exposed a network API, but probes explicitly show no OpenAPI/swagger spec exists at any candidate path and no llms.txt for the technical docs.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.solokeys.dev/openapi.json, https://docs.solokeys.dev/swagger.json, https://docs.solokey…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.solokeys.dev/llms.txt”
   • [probe] “PROBE runtime (recorded 2026-09-15): solokeys.com serves an llms.txt ('# Agent Instructions — SoloKeys'), but it is Shopify's platform-gener…”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round drawn
   Nitrokey—none0/10

   Nitrokey ships a CLI (nitropy) and Python SDK that could in principle be scripted, but no evidence in the pack shows any documented bulk-operation workflow (e.g., batch provisioning, mass key management, scripted multi-device automation) for AI-native or automated bulk use. Only single-device/product feature lists and an 'Entra ID provisioning' mention appear, with no concrete bulk-operation documentation or example. missing for 10: documented bulk/batch API or CLI commands, evidence of managing many items/devices at once, automation examples for large-scale provisioning.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [claimed-docs] “Nitrokey Provisioning for Entra ID”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Openpgp

1. developerKeep OpenPGP keys on the device and use them for git commit signing and encrypted email

   weight 2 · round to Nitrokey
   Nitrokey✓fullclaimed8/10

   Nitrokey devices support the OpenPGP smart card standard with on-device key generation, touch confirmation, and documented integration with Thunderbird for encrypted email; the OpenPGP card standard is also the basis for git commit signing via GPG, which is a well-known standard use case for OpenPGP smart cards. Docs explicitly cover keygen-on-device, touch confirmation, and Thunderbird email use. Missing for 10: explicit first-party documentation naming 'git commit signing' as a use case, and independent hands-on corroboration of the OpenPGP-card signing workflow.

   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “Keygen on device”
   • [claimed-docs] “Thunderbird”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”

   proof ↗⚑ flag

   SoloKeys Solo 2!disputedcontradicted3/10

   The GitHub README lists OpenPGP as a supported protocol (solokeys-gh-1, solokeys-gh-8), which would enable git commit signing and encrypted email use cases, but community comments directly contradict this — users report 'it doesn't do OpenPGP' and 'I'm really hoping they bring GPG to the Solokey... but I'm starting to lose confidence' (solokeys-comm-2, solokeys-comm-4). There is no first-party documentation walking through GPG key generation, git signing setup, or email encryption workflows, and no independent hands-on confirmation that OpenPGP actually works on shipped hardware. Missing for 10: verified working OpenPGP applet on shipped Solo 2 units, official docs for GPG/git-signing setup, and independent confirmation resolving the community's contradicting reports.

   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”
   • [github] “also speaks OATH (TOTP/HOTP), PIV, and OpenPGP”
   • [community] “Nice, I'd love this as an open source yubikey replacement. But it doesn't do OpenPGP, I rely on that way too much sadly... If they add that …”
   • [community] “I'm really hoping they bring GPG to the Solokey V1, but I'm starting to lose confidence”

   proof ↗⚑ flag

Otp

1. power userThe key covers legacy one-time-password schemes — TOTP/HOTP slots or challenge-response — for services that still lack WebAuthn

   weight 2 · round to SoloKeys Solo 2
   Nitrokey~partialclaimed6/10

   Docs explicitly list 'Two Factor Authentication' and OTP support (login using OTP for Google/Facebook), and the Nitrokey 3 product page mentions 'one-time passwords' among combined features, indicating TOTP/HOTP slot support. However, no explicit mention of HOTP challenge-response mode, no detail on number of slots, no independent hands-on verification of OTP functionality, and community evidence focuses on other features (HSM, durability) without confirming OTP reliability. Missing for 10: explicit challenge-response documentation, slot-count/configuration details, independent hands-on confirmation of OTP/HOTP working as advertised.

   • [claimed-docs] “Login to websites (e.g. Google, Facebook) using secure One Time Passwords (OTP), U2F or ordinary static passwords.”
   • [claimed-docs] “Two Factor Authentication”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”

   proof ↗⚑ flag

   SoloKeys Solo 2✓fullprobed6/10

   GitHub docs explicitly state Solo 2 speaks OATH (TOTP/HOTP) in addition to FIDO2/WebAuthn, PIV, and OpenPGP, directly supporting legacy OTP slot functionality. However, missing for 10: no CLI/setup walkthrough for configuring TOTP/HOTP slots, no independent hands-on confirmation the OATH applet works reliably, and a runtime probe shows the official Solo CLI has bit-rotted (import errors) and firmware hasn't been updated in years, raising doubts about current usability.

   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”
   • [github] “also speaks OATH (TOTP/HOTP), PIV, and OpenPGP”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Piv

1. it adminThe key acts as a PIV smart card for certificate-based login — workstation sign-in, VPN, and code signing with keys that never leave the device

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity6/10

   Nitrokey documents PIV support explicitly (nitrokey-docs-11) plus Windows Login/AD, S/MIME, PAM (Linux), OpenVPN and on-device keygen with touch confirmation (nitrokey-docs-5,6,7,8,15), covering workstation login, VPN and code-signing-adjacent use cases with non-exportable keys. However, code-signing evidence is limited to CLI/attestation tooling rather than a dedicated PIV code-signing workflow, and community reports flag missing feature parity and cryptographic limitations (Ed25519 unsupported, non-standard attestation cert formats) versus competitors, plus slow/incomplete rollout of promised features. Missing for 10: dedicated PIV-specific code-signing documentation/integration guide, independent hands-on verification of PIV smart-card login working end-to-end, and confirmation that PIV certs are exportable/usable in enterprise CA workflows.

   • [claimed-docs] “PIV (Personal Identity Verification)”
   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [claimed-docs] “Keygen on device”
   • [claimed-docs] “PAM (Linux)”
   • [claimed-docs] “OpenVPN”
   • [community] “I'm currently using both Nitrokeys and YubiHSMs on a client project. Nitrokeys can't do Ed25519, stuck with NSA Suite B for ECC. Attestation…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   SoloKeys Solo 2~partialprobed4/10

   GitHub docs confirm Solo 2 'speaks... PIV' alongside FIDO2/OATH/OpenPGP, supporting the core claim that certificate-based smart-card auth is possible, but there is no vendor documentation on PIV provisioning, workstation/VPN sign-in setup, or code-signing workflows, and a runtime probe shows the official CLI is bit-rotted and firmware hasn't shipped a release in 4 years, raising doubt about current enterprise usability. Missing for 10: PIV certificate enrollment/management docs, workstation/VPN sign-in integration guides, code-signing workflow evidence, and confirmation the PIV applet still functions with current tooling.

   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”
   • [github] “also speaks OATH (TOTP/HOTP), PIV, and OpenPGP”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Ssh

1. developerMy SSH keys can be hardware-backed on the device — via FIDO2 sk-ssh keys, PIV, or OpenPGP — so server access requires a physical touch

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity6/10

   Docs confirm SSH login via certificates, PIV support, and OpenPGP card with touch confirmation, and a dedicated 'SSH Keys' page under the FIDO2 section suggests sk-ssh key support, aligning with the hardware-backed SSH story. However, there's no explicit walkthrough of FIDO2 sk-ssh key generation/usage, and community threads note the Nitrokey 3 has lagged in reaching feature parity with competitors, raising some doubt about full FIDO2 SSH robustness. Missing for 10: explicit sk-ssh setup documentation/examples, independent hands-on confirmation of FIDO2 SSH touch-to-authenticate working end-to-end.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Login to computers and network services (e.g. SSH) using certificates.”
   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “PIV (Personal Identity Verification)”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”

   proof ↗⚑ flag

   SoloKeys Solo 2!disputedcontradicted4/10

   GitHub docs assert the device 'speaks OATH (TOTP/HOTP), PIV, and OpenPGP' alongside its core FIDO2/WebAuthn support, which would in principle back sk-ssh (FIDO2), PIV, and GPG-based SSH keys — but a community commenter on the same Solo2 announcement explicitly states 'it doesn't do OpenPGP,' and an independent runtime probe shows the official solo-python CLI is broken (ImportError with current python-fido2) and firmware hasn't shipped since 2022, casting doubt that these advertised protocols are actually usable today for SSH auth. Missing for 10: explicit sk-ssh/PIV/OpenPGP SSH-key setup documentation, working current CLI/firmware evidence, and resolution of the OpenPGP support contradiction.

   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”
   • [github] “also speaks OATH (TOTP/HOTP), PIV, and OpenPGP”
   • [community] “Nice, I'd love this as an open source yubikey replacement. But it doesn't do OpenPGP, I rely on that way too much sadly... If they add that …”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Agent audit

1. ai-native userAn agent can read a key's state programmatically — serial, firmware version, enabled applications, stored credentials — to audit security posture across a fleet

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed5/10

   The official nitropy CLI (and Python SDK) can programmatically query device attributes such as version and connected devices (e.g., 'nitropy version', device listing), giving agents a scriptable way to pull serial/firmware info, and firmware update tooling is documented. However, there is no evidence of a documented way to enumerate 'enabled applications' or 'stored credentials' via CLI/API for fleet-wide security audits, and no fleet-management or structured (JSON/API) output is shown. Missing for 10: documented commands/output for enabled applications and stored credential enumeration, structured machine-readable output format, and any fleet-audit tooling or API/OpenAPI spec (probes show none exists).

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   SoloKeys Solo 2~partialprobed3/10

   The Solo 2 CLI exposes some device-state commands (`solo2 list` for connected devices/serials, `solo2 app admin ...` for config) suggesting basic programmatic querying, but there is no evidence of commands to enumerate firmware version, enabled applications, or stored credentials for fleet auditing. A runtime probe also shows the official Python CLI tooling (solo-python) is broken due to dependency incompatibility, undermining reliability of programmatic access. missing for 10: documented API/CLI output for firmware version and enabled-app enumeration, credential enumeration, a working/maintained CLI tool, any structured/machine-readable output format for fleet-scale auditing.

   • [github] “solo2 list # list connected devices (alias: solo2 ls)”
   • [github] “solo2 app admin set led 007f7f 00007f # set led to teal (idle) / blue (active) - use 000000 to turn the led off”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Attestation

1. security engineerVerify device attestation at registration to enforce that only genuine, approved key models are enrolled

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity4/10

   Nitrokey ships FIDO2 (which includes device attestation) and PIV, but there is no documentation of an attestation verification workflow for registration, and a hands-on report notes attestation certificates can't be exported via standard PKCS#11 and require a custom vendor tool plus a non-standard ASN.1 cert format, adding real friction for engineers building attestation checks. missing for 10: first-party docs on attestation cert format/verification API, standard PKCS#11/FIDO2 attestation export support, independent confirmation of a smooth registration-time attestation check.

   • [claimed-docs] “SSH Keys”
   • [community] “I'm currently using both Nitrokeys and YubiHSMs on a client project. Nitrokeys can't do Ed25519, stuck with NSA Suite B for ECC. Attestation…”

   proof ↗⚑ flag

   SoloKeys Solo 2~partialclaimed3/10

   The docs confirm Solo 2 ships with a factory attestation key and even allow customizing/generating your own attestation key pair for bulk deployment, implying WebAuthn/FIDO2 attestation is present in principle. However there is no documentation of a FIDO Alliance MDS listing, stable AAGUID, or any RP-side verification workflow that a security engineer could use to confirm the device model at registration — and the ability to swap the attestation key yourself could actually undermine trust in a fixed identity. missing for 10: MDS/AAGUID metadata for RP verification, documented attestation-cert chain details, guidance for enterprises on enforcing genuine-model checks, independent confirmation that registration-time attestation works as expected.

   • [claimed-docs] “If you don't want to use the default attestation key that Solo builds with, you can create your own and program it.”
   • [claimed-docs] “Now to generate & sign the attestation key pair that will go on your device, or maybe 100,000 devices :)”
   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”

   proof ↗⚑ flag

Cli

1. developerConfigure and manage the key from an official CLI — enable applications, set PINs, manage slots, read device state — scriptably

   weight 3 · round to Nitrokey
   Nitrokey✓fullprobed8/10

   Nitrokey ships an official CLI, nitropy, documented at docs.nitrokey.com/software/nitropy and verified installable/runnable via PyPI, described as a tool to interact with Nitrokey devices (identity/version checks, firmware updates, etc.), plus a companion Python SDK — this covers scriptable device configuration and management. Missing for 10: explicit documentation/examples in the evidence pack of specific subcommands for PIN-setting, slot management, and app enable/disable, and independent hands-on confirmation of full feature parity across all device operations.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [claimed-docs] “Firmware Update”

   proof ↗⚑ flag

   SoloKeys Solo 2!disputedcontradicted3/10

   Docs and GitHub show a `solo2` CLI with some admin commands (`solo2 list`, `solo2 app admin set led`, firmware `update`) but no documented commands for setting PINs or managing slots, and reading device state relies on generic third-party `fido2-token` rather than a Solo-specific command. A runtime probe found the official Solo CLI (solo-python) actually fails to even run (`ImportError: cannot import name CTAP1`) due to incompatibility with current fido2 2.x, and firmware hasn't been released in 4 years — concrete evidence the tooling has bit-rotted rather than delivering the claimed scriptable management. missing for 10: working PIN-setting command, slot management, device-state reporting, and a CLI that runs without import errors on current dependencies.

   • [github] “solo2 app admin set led 007f7f 00007f # set led to teal (idle) / blue (active) - use 000000 to turn the led off”
   • [github] “solo2 list # list connected devices (alias: solo2 ls)”
   • [claimed-docs] “You can "wipe" a device using `fido2-token -R`”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Sdks

1. developerOfficial SDKs let me integrate the key into my own desktop and mobile apps

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed5/10

   Nitrokey provides nitropy CLI and a Python 'nitrokey' SDK on PyPI plus PIV/OpenPGP/PKCS#11 support that developers can integrate into tooling, but there is no evidence of official mobile SDKs (iOS/Android app libraries) or desktop app integration SDKs beyond the low-level Python/CLI tooling. missing for 10: dedicated mobile (iOS/Android) SDKs, higher-level desktop app integration libraries (e.g. for Electron/Swift/Java), first-party sample apps or API docs showing SDK usage in third-party apps.

   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [claimed-docs] “Android / NitroPhone”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   Evidence shows only a device-management CLI (solo2 app admin/list) and firmware-building/customization tooling for the key itself, not any SDK for embedding the key into third-party desktop or mobile applications. The runtime probe even shows the existing Solo Python CLI is broken/bit-rotted, and no library/SDK for app integration is documented anywhere in the pack.

   • [github] “solo2 app admin set led 007f7f 00007f # set led to teal (idle) / blue (active) - use 000000 to turn the led off”
   • [github] “solo2 list # list connected devices (alias: solo2 ls)”
   • [claimed-docs] “To build, develop and debug the firmware for the STM32L432.”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Agent approval

1. ai-native userRequire a physical key touch as the human-approval step for sensitive automated or agent-initiated actions

   weight 1 · round to SoloKeys Solo 2
   Nitrokey—none0/10

   Nitrokey documents generic touch-confirmation for OpenPGP/FIDO2 operations, but there is no evidence tying this to AI-agent or automated-action approval workflows, MCP, or any agentic tooling — the capability as described in the story is unevidenced.

   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Two Factor Authentication”

   proof ↗⚑ flag

   SoloKeys Solo 2~partialprobed3/10

   Solo 2 documents a generic touch-to-confirm step for WebAuthn/FIDO2 authentication (solokeys-docs-1), which could theoretically gate any human-in-the-loop confirmation, but there is no evidence tying this to AI-agent-initiated action approval flows, agentic tool integrations, or any AI-native ecosystem support. Additionally, runtime evidence shows the official CLI is broken/bit-rotted and firmware hasn't shipped in 4 years, raising doubts about active ecosystem maintenance. Missing for 10: any documentation or integration example of using Solo 2 touch confirmation as an approval gate for AI/agent workflows, evidence of SDK/API hooks for agent tooling, and independent confirmation of this use case.

   • [claimed-docs] “When prompted, touch the capacitive sensor on your Solo 2 to confirm.”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Compatibility

1. power userThe key works across my operating systems and browsers, with a published compatibility catalog of supported services

   weight 2 · round to SoloKeys Solo 2
   Nitrokey!disputedcontradicted4/10

   Docs scatter claims of broad compatibility (SSH, FIDO2, OTP, PIV, OpenPGP, Windows/AD, Office 365, Nextcloud, Thunderbird, OpenVPN) but there is no single published compatibility catalog/matrix of supported services or browsers. Community evidence concretely contradicts smooth cross-platform delivery: users report needing to allow unsigned driver installation on Windows, and multiple reports that Nitrokey 3 still lists many features as 'planned' and lags Yubikey in feature parity years after purchase. missing for 10: a unified compatibility matrix/catalog page, confirmation of parity across all claimed services, resolution of the Windows driver-signing friction.

   • [claimed-docs] “Login to websites (e.g. Google, Facebook) using secure One Time Passwords (OTP), U2F or ordinary static passwords.”
   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [community] “To install the driver, you may need to allow the installation of unsigned drivers first. Nope, thanks.”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   SoloKeys Solo 2~partialprobed3/10

   Solo 2 claims broad compatibility (any USB port, no drivers, FIDO2/passkey standard, NFC for Android/iOS, OATH/PIV/OpenPGP) but there is no published compatibility catalog listing specific supported services/sites, and a runtime probe shows the official CLI tooling has bit-rotted and firmware hasn't been updated in years, raising doubts about maintained cross-platform support. Missing for 10: a published service/site compatibility list, browser-specific compatibility documentation, and evidence the tooling/firmware is actively maintained to keep pace with OS/browser changes.

   • [claimed-docs] “Passkeys are replacing passwords across the web. Solo 2 supports the passkey standard — except yours stays on your key. Not their cloud.”
   • [claimed-docs] “Insert your Solo 2 into any USB port. No software or drivers required.”
   • [claimed-docs] “Everything in Solo 2 plus NFC tap-to-authenticate for compatible Android and iOS devices.”
   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Recovery

1. security engineerThe vendor documents a credible lockout-recovery strategy — registering a backup key, and what is and is not recoverable if a key is lost

   weight 3 · round drawn
   Nitrokey—none0/10

   No evidence pack item documents a vendor-provided lockout-recovery strategy (e.g., registering a backup Nitrokey, or what OpenPGP/FIDO2/PIV credentials are or are not recoverable if a key is lost). The closest mention is a third-party community comment about offline key escrow for the unrelated HSM product, not official documentation of recovery/backup-key enrollment.

   • [community] “Used the original Nitrokey HSM model on a code-signing server project. The applet running inside is not free/open source but dev tools and d…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   No evidence in the pack discusses backup key enrollment, multi-key registration strategies, or what is/isn't recoverable if a Solo 2 is lost — documentation covers setup, building, and CLI usage but never addresses lockout/recovery planning.

   ⚑ flag

Setup

1. power userFirst-time setup is guided — clear instructions or a setup app walk me through registering the key with my accounts

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed5/10

   Nitrokey provides scattered feature-specific docs (SSH, PIV, OpenPGP, FIDO2, general instructions) and a CLI tool (nitropy) for device management, which can guide account registration for specific services, but there's no single unified setup wizard/app walking a user end-to-end through registering with major accounts. Community feedback also flags real setup friction (e.g., needing to allow unsigned driver installation) that undercuts a smooth guided experience. Missing for 10: a dedicated onboarding app/wizard, first-party account-registration walkthroughs (e.g., for Google/Microsoft/GitHub), and independent hands-on confirmation that setup is smooth.

   • [claimed-docs] “Two Factor Authentication”
   • [claimed-docs] “General Instructions”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [community] “To install the driver, you may need to allow the installation of unsigned drivers first. Nope, thanks.”

   proof ↗⚑ flag

   SoloKeys Solo 2~partialprobed3/10

   Docs mention simple plug-and-play basics ('insert into USB port, no software required', 'touch sensor to confirm') but there is no evidence of a dedicated setup app or step-by-step account-registration walkthrough; the FIDO2 side of onboarding is essentially per-website. Additionally, a runtime probe shows the official companion CLI is bit-rotted (import errors) and firmware hasn't been updated in years, undermining confidence in any first-time-setup tooling. Missing for 10: a documented onboarding wizard/app, account-registration walkthrough for accounts, working companion CLI/tooling.

   • [claimed-docs] “When prompted, touch the capacitive sensor on your Solo 2 to confirm.”
   • [claimed-docs] “Insert your Solo 2 into any USB port. No software or drivers required.”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Source

1. security engineerThe firmware is open source or independently audited, so I don't have to take the vendor's word for what runs on the device

   weight 2 · round to SoloKeys Solo 2
   Nitrokey~partialprobed7/10

   Nitrokey 3 firmware is confirmed open source (Rust, dual Apache2.0/MIT licensed, tagged releases on GitHub) which lets engineers inspect what runs on the device, but the HSM applet is explicitly noted as not open source, and there is no evidence of an independent third-party security audit of the firmware. missing for 10: independent audit report, confirmation that all product lines (not just Nitrokey 3) are open source, no audit mention for the closed HSM applet.

   • [github] “This software is fully open source.”
   • [github] “The Nitrokey 3 firmware is written in Rust. It uses the Trussed firmware framework and is developed in collaboration with SoloKeys”
   • [github] “All software, unless otherwise noted, is dual licensed under Apache 2.0 and MIT license.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey 3 firmware is open source in Rust WITH tagged, installable releases — https://github.com/Nitro…”
   • [community] “Used the original Nitrokey HSM model on a code-signing server project. The applet running inside is not free/open source but dev tools and d…”

   proof ↗⚑ flag

   SoloKeys Solo 2✓fullprobed8/10

   The Solo 2 firmware is openly published on GitHub, buildable from source, and the 'Hacker' variant explicitly supports flashing custom firmware, letting anyone inspect and verify what runs on the device; this is corroborated by community commentary confirming 'it's open source firmware, not open source hardware.' Updates are also SHA-256 verified before flashing, adding transparency to the update process. missing for 10: no formal independent third-party security audit is cited, and runtime evidence shows the firmware/tooling has not been updated since 2022, raising questions about ongoing maintenance of the open codebase.

   • [github] “Solo 2 Hacker — the same hardware, unlocked. Flash your own firmware, experiment with new features, and learn how a security key works end t…”
   • [github] “On a **Hacker** key you can build and flash your own firmware.”
   • [github] “`update` downloads the signed release, **verifies its SHA-256**, and flashes it.”
   • [community] “This is an LPC55S69. So it's open source firmware, not open source hardware.”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Updates

1. security engineerThe vendor has a clear firmware update and vulnerability-response story — advisories, affected-model lookup, and how fixes reach devices

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed4/10

   Nitrokey documents a firmware-update mechanism (dedicated firmware-update guide, nitropy CLI, tagged GitHub releases like v1.8.3) and open-source firmware for transparency, but there is no evidence of a formal security-advisory feed, CVE list, or affected-model lookup tool comparable to a vendor security bulletin process; a community post references a real key-extraction issue discussed ad hoc rather than via a documented advisory pipeline. Missing for 10: dedicated security advisories page, CVE/vulnerability database, affected-model/version lookup tool, and clear SLA for how fixes reach devices beyond generic update docs.

   • [claimed-docs] “Firmware Update”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey 3 firmware is open source in Rust WITH tagged, installable releases — https://github.com/Nitro…”
   • [community] “Author here: extracting Nitrokey HSM RSA private keys is not a vulnerability per se - it requires the attacker to already have the keys to t…”
   • [github] “This software is fully open source.”

   proof ↗⚑ flag

   SoloKeys Solo 2!disputedcontradicted3/10

   The GitHub docs describe a signed, SHA-256-verified update mechanism (solokeys-gh-2), but there is no evidence of published security advisories or an affected-model lookup, and a runtime probe shows the official CLI is bit-rotted (ImportError against current fido2 lib) and no firmware release has shipped in ~4 years despite ongoing dependency commits — directly undercutting the claim that fixes reliably reach devices. missing for 10: security advisory feed/CVE list, affected-model/version lookup tool, evidence of recent firmware releases actually reaching users, working update tooling.

   • [github] “`update` downloads the signed release, **verifies its SHA-256**, and flashes it.”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Agent provisioning

1. ai-native userAn agent can drive key provisioning end to end — ordering, assignment, pre-registration — through documented enterprise APIs instead of a human-only console

   weight 2 · round drawn
   Nitrokey—none0/10

   Nitrokey documents an nitropy CLI for on-device configuration and an Entra ID provisioning integration, but there is no evidence of a documented enterprise API supporting agent-driven ordering, assignment, or pre-registration workflows — OpenAPI/API probes all returned 404. missing for 10: documented REST/enterprise API for ordering and fleet assignment, evidence of programmatic pre-registration, any API reference beyond CLI tooling.

   • [claimed-docs] “Nitrokey Provisioning for Entra ID”
   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   There is no evidence of any enterprise/fleet management API for ordering, assignment, or pre-registration of keys — the CLI is a local hardware management tool (list, flash, LED), and probe evidence shows no OpenAPI/API docs exist and the CLI itself is bit-rotted. This is a consumer/hacker hardware key product with no enterprise provisioning system at all.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.solokeys.dev/openapi.json, https://docs.solokeys.dev/swagger.json, https://docs.solokey…”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”
   • [github] “solo2 list # list connected devices (alias: solo2 ls)”

   proof ↗⚑ flag

Delivery

1. it adminAn enterprise delivery service ships keys directly to distributed employees, driven by an API or console rather than manual logistics

   weight 2 · round drawn
   Nitrokey—none0/10

   Evidence covers device features (FIDO2, OpenPGP, PIV), firmware/CLI tooling, and community feedback on hardware/support quality, but nothing addresses enterprise bulk-shipping/fleet logistics, an API/console for distributing keys directly to distributed employees, or any provisioning-and-delivery service comparable to fleet-management logistics.

   ⚑ flag

   SoloKeys Solo 2—none0/10

   No evidence of any enterprise provisioning/shipping API, console, or fleet-deployment logistics integration; SoloKeys is a consumer hardware key sold via a Shopify store with no fleet-management tooling documented, and CLI/API evidence is limited to device-local admin commands and firmware building. Probes even show bit-rot in the CLI and no API/OpenAPI documentation exists.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.solokeys.dev/openapi.json, https://docs.solokeys.dev/swagger.json, https://docs.solokey…”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”
   • [claimed-docs] “Pack of colored cases for Solo 2”
   • [github] “solo2 list # list connected devices (alias: solo2 ls)”

   proof ↗⚑ flag

Idp

1. it adminThe key integrates with my identity provider — Okta, Entra ID, Google Workspace — and I can enforce policies requiring hardware-key authentication

   weight 2 · round to Nitrokey
   Nitrokey~partialclaimed4/10

   Nitrokey documents FIDO2/PIV/OpenPGP protocol support and a specific 'Nitrokey Provisioning for Entra ID' tool, showing some IdP integration, but there is no evidence of Okta or Google Workspace integration, nor any admin console/policy engine to enforce hardware-key-only authentication fleet-wide. Missing for 10: Okta integration, Google Workspace integration, centralized policy enforcement/fleet management console, documentation of admin-side enrollment/compliance workflows.

   • [claimed-docs] “Nitrokey Provisioning for Entra ID”
   • [claimed-docs] “Windows Login and S/MIME Email Encryption with Active Directory”
   • [claimed-docs] “PIV (Personal Identity Verification)”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   No evidence anywhere in the pack mentions IdP integrations (Okta, Entra ID, Google Workspace), fleet enrollment/management tools, or policy enforcement for hardware-key authentication; evidence only covers WebAuthn/FIDO2 protocol support, firmware building, and hardware details. This is a plausible axis for a security key vendor (many competitors offer admin/fleet consoles), but SoloKeys shows nothing to support it.

   ⚑ flag

Provisioning

1. it adminProvision keys across an organization at scale — pre-registration, bulk configuration, and lifecycle tracking of issued keys

   weight 3 · round to Nitrokey
   Nitrokey~partialprobed3/10

   Nitrokey ships an official CLI (nitropy) and Python SDK for scripting device operations, and docs reference 'Nitrokey Provisioning for Entra ID,' suggesting some enterprise provisioning path exists, but there is no evidence of bulk pre-registration workflows, centralized fleet dashboards, or lifecycle/audit tracking across many issued keys. missing for 10: bulk enrollment/pre-registration tooling, centralized admin console for fleet inventory, lifecycle/revocation tracking at scale, independent case studies of large deployments.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [claimed-docs] “Nitrokey Provisioning for Entra ID”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   Evidence covers individual key setup, CLI device listing/config (`solo2 list`, `admin set led`), and custom attestation-key generation, with one offhand mention of building attestation keys 'for maybe 100,000 devices'—but there is no documented bulk-enrollment workflow, admin console, pre-registration pipeline, or lifecycle/issuance tracking system for organizations. Runtime probes further show the official CLI is broken (ImportError) and no firmware has shipped in 4 years, undercutting any claim of active enterprise tooling.

   • [claimed-docs] “Now to generate & sign the attestation key pair that will go on your device, or maybe 100,000 devices :)”
   • [github] “solo2 list # list connected devices (alias: solo2 ls)”
   • [github] “solo2 app admin set led 007f7f 00007f # set led to teal (idle) / blue (active) - use 000000 to turn the led off”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Certifications

1. it adminCertified models exist for regulated environments — FIPS 140 validated or Common Criteria certified — with documented durability (water/crush resistance)

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity3/10

   Nitrokey documents a Common Criteria EAL 6+ certified secure element in the Nitrokey 3 (nitrokey-docs-16), satisfying the certification half of the story, but there is no mention anywhere in the evidence of FIPS 140 validation, nor any documented water/crush-resistance or ruggedization specs. Community hands-on feedback actively undercuts the durability angle, describing the U2F key as feeling 'flimsy' compared to competitors (nitrokey-comm-3, nitrokey-comm-4). Missing for 10: FIPS 140 validation evidence, explicit IP/MIL-STD or water/crush durability specs, and independent corroboration of ruggedness rather than community complaints about build quality.

   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [community] “I wish they would make something that felt more durable. I bought the U2F key and the combination of plastic and not being sure where to pre…”
   • [community] “Unlike some competitors, Nitrokey contains a complete and standard compliant USB plug... Here I am waiting for a Type-C from them. Yet they …”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   No evidence of FIPS 140 validation or Common Criteria certification anywhere in the pack; only a community comment mentions 'water resistant' informally (solokeys-comm-7), and another comment casts doubt on tamper-resistance claims (solokeys-comm-1). No documented crush resistance or regulated-environment certification exists.

   • [community] “Solo v2 is much more robust, water resistant, has stronger NFC & reversible usb plug. The micro is a NXP LPC55S6x with extra security featur…”
   • [community] “I'm still curious how the key is tamper resistent when filling it with transparent epoxy... it should be fairly easy to remove the epoxy and…”

   proof ↗⚑ flag

Connectors

1. power userThe lineup covers my ports and carry style — USB-C and USB-A models, keychain and low-profile nano form factors

   weight 2 · round to Nitrokey
   Nitrokey~partialcommunity4/10

   Evidence indirectly shows both USB-A and USB-C variants exist (the shop page references 'nk3an-nitrokey-3a-nfc' and a community comment mentions ordering a 'Nitrokey 3C NFC'), suggesting the lineup covers both port types. However, there is no evidence of keychain or nano low-profile form factors anywhere in the pack, and one community comment even complains about waiting years for a Type-C model, casting some doubt on breadth/availability. Missing for 10: explicit nano/keychain form-factor SKUs, confirmed current availability of USB-C models, first-party spec sheet comparing form factors.

   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [community] “Unlike some competitors, Nitrokey contains a complete and standard compliant USB plug... Here I am waiting for a Type-C from them. Yet they …”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   Evidence shows Solo 2 exists as a security key with NFC variant and generic USB port compatibility, and community comments mention a 'reversible USB-A'/'reversible usb plug', but there is no evidence of a broader lineup with distinct USB-C vs USB-A SKUs or keychain vs low-profile nano form factors — only a single case/color accessory line is mentioned.

   • [claimed-docs] “Insert your Solo 2 into any USB port. No software or drivers required.”
   • [claimed-docs] “Everything in Solo 2 plus NFC tap-to-authenticate for compatible Android and iOS devices.”
   • [community] “"Reversible USB-A" now there's a feature I wish we'd see more often!”
   • [community] “Solo v2 is much more robust, water resistant, has stronger NFC & reversible usb plug. The micro is a NXP LPC55S6x with extra security featur…”
   • [claimed-docs] “Pack of colored cases for Solo 2”

   proof ↗⚑ flag

Nfc

1. power userTap the key on my phone over NFC to authenticate in mobile browsers and apps

   weight 2 · round to SoloKeys Solo 2
   Nitrokey~partialclaimed4/10

   Nitrokey sells an NFC-enabled model (Nitrokey 3A NFC) and documents FIDO2/U2F/OTP login flows and an Android/NitroPhone integration, implying NFC tap-to-auth is technically supported, but no evidence explicitly confirms tapping the key against a phone to authenticate in mobile browsers/apps, nor any hands-on report of this working. Missing for 10: explicit documentation or user testimony of NFC-based authentication on phones, coverage across major mobile browsers/apps, and confirmation it works as smoothly as competitors.

   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [claimed-docs] “Android / NitroPhone”
   • [claimed-docs] “Two Factor Authentication”

   proof ↗⚑ flag

   SoloKeys Solo 2✓fullclaimed7/10

   SoloKeys explicitly markets NFC tap-to-authenticate for compatible Android and iOS devices as a feature of Solo 2, supporting WebAuthn/passkeys which work across mobile browsers/apps. Missing for 10: no independent hands-on confirmation of NFC mobile browser/app compatibility, and community discussion focuses on other aspects (tamper resistance, OpenPGP) rather than validating NFC mobile use.

   • [claimed-docs] “Everything in Solo 2 plus NFC tap-to-authenticate for compatible Android and iOS devices.”
   • [claimed-docs] “Passkeys are replacing passwords across the web. Solo 2 supports the passkey standard — except yours stays on your key. Not their cloud.”
   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Nitrokey
   Nitrokey~partialprobed4/10

   Nitrokey ships an official CLI (nitropy) and Python SDK that can configure/manage devices programmatically, confirmed to install and run via PyPI, but there is no formal REST/OpenAPI interface (all API endpoint probes 404) and no explicit vendor claim of full UI/CLI feature parity for AI-native automation. Missing for 10: documented API/OpenAPI spec, explicit parity statement between GUI app and nitropy CLI, and independent verification that all UI-exposed features are scriptable via nitropy.

   • [claimed-docs] “nitropy - Nitrokey Documentation”
   • [probe] “official CLI documented at https://docs.nitrokey.com/software/nitropy/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey's official nitropy CLI installs keylessly from PyPI and identifies itself — `uvx --from pynitr…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.nitrokey.com/openapi.json, https://docs.nitrokey.com/swagger.json, https://docs.nitroke…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Nitrokey
   Nitrokey!disputedcontradicted3/10

   Nitrokey's firmware and licensing are open source (nitrokey-gh-1, nitrokey-gh-3) and it uses open standards like FIDO2/OpenPGP/PIV, which in principle avoid lock-in, but a hands-on user report describes the opposite of clean data portability: Nitrokey attestation certs 'can't be exported via PKCS#11' and require a 'custom vendor shell' with a non-standard ASN.1 cert container (nitrokey-comm-2) — directly contradicting an open, portable data-export claim. Missing for 10: any first-party documentation of a bulk/data export feature or standard export format for stored secrets, and no counter-evidence resolving the community-reported non-standard export path.

   • [github] “This software is fully open source.”
   • [github] “All software, unless otherwise noted, is dual licensed under Apache 2.0 and MIT license.”
   • [community] “I'm currently using both Nitrokeys and YubiHSMs on a client project. Nitrokeys can't do Ed25519, stuck with NSA Suite B for ECC. Attestation…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   The evidence pack shows Solo 2 supports open standards (WebAuthn, OATH, PIV, OpenPGP) and lets users customize/replace the attestation key or wipe the device, but there is no documentation of any way to export stored credentials/private key material in open formats to migrate elsewhere — by design, FIDO2/PIV/OpenPGP keys generated on-device are non-extractable. missing for 10: any documented data-export/migration path, evidence of extractable key material, or open-format backup/portability tooling.

   • [claimed-docs] “You can "wipe" a device using `fido2-token -R`”
   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”
   • [claimed-docs] “If you don't want to use the default attestation key that Solo builds with, you can create your own and program it.”
   • [claimed-docs] “Now to generate & sign the attestation key pair that will go on your device, or maybe 100,000 devices :)”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round drawn
   Nitrokey✓fullprobed8/10

   Nitrokey 3 firmware source is hosted on GitHub, explicitly stated to be fully open source, dual-licensed under Apache 2.0/MIT, with tagged releases confirming active open development. This directly satisfies reading source under an open license for the core firmware. Missing for 10: confirmation that all components (e.g., HSM applet, some proprietary parts noted in community evidence) are open, and no independent audit of license completeness beyond firmware repo.

   • [github] “This software is fully open source.”
   • [github] “The Nitrokey 3 firmware is written in Rust. It uses the Trussed firmware framework and is developed in collaboration with SoloKeys”
   • [github] “All software, unless otherwise noted, is dual licensed under Apache 2.0 and MIT license.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Nitrokey 3 firmware is open source in Rust WITH tagged, installable releases — https://github.com/Nitro…”

   proof ↗⚑ flag

   SoloKeys Solo 2✓fullcommunity8/10

   The firmware source is hosted openly on GitHub (solokeys/solo2), with build instructions, hackable firmware flashing, and even a dedicated 'Hacker' key edition explicitly for reading/modifying source and firmware end-to-end. Community confirms firmware is open source (though hardware/chip is not), corroborating the licensing model. Missing for 10: no explicit license file/name cited, and no independent audit of license terms beyond community mention that firmware (not hardware) is open.

   • [github] “Solo 2 Hacker — the same hardware, unlocked. Flash your own firmware, experiment with new features, and learn how a security key works end t…”
   • [github] “On a **Hacker** key you can build and flash your own firmware.”
   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”
   • [claimed-docs] “To build, develop and debug the firmware for the STM32L432.”
   • [community] “This is an LPC55S69. So it's open source firmware, not open source hardware.”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to SoloKeys Solo 2
   Nitrokey—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   SoloKeys Solo 2~partialprobed5/10

   The Solo 2 'Hacker' edition ships with fully open-source firmware that users can build, flash, and customize themselves (own attestation keys, own firmware, full toolchain via Rust/cargo), which is the closest analogue to 'self-hosting' for a hardware security key — no cloud dependency by design. However, runtime evidence shows the surrounding tooling has bit-rotted (solo-python CLI fails on current fido2 libs) and no firmware release has shipped in 4 years, undermining confidence that self-building/self-hosting the core product is currently practical. Missing for 10: a working, up-to-date official build/flash pipeline, and independent confirmation that a user can successfully self-build current firmware today.

   • [github] “Solo 2 Hacker — the same hardware, unlocked. Flash your own firmware, experiment with new features, and learn how a security key works end t…”
   • [github] “On a **Hacker** key you can build and flash your own firmware.”
   • [claimed-docs] “If you don't want to use the default attestation key that Solo builds with, you can create your own and program it.”
   • [claimed-docs] “To build, develop and debug the firmware for the STM32L432.”
   • [claimed-docs] “rustup target install thumbv8m.main-none-eabi cargo install flip-link cargo install cargo-binutils cargo install probe-rs-tools”
   • [claimed-docs] “cargo build --release --features board-lpcxpresso55,develop”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

1. ai-native userControl data retention and deletion

   weight 2 · round to SoloKeys Solo 2
   Nitrokey—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   SoloKeys Solo 2~partialclaimed4/10

   Evidence shows credentials are stored only on-device rather than in a vendor cloud (solokeys-docs-2), and a device wipe is possible via the third-party `fido2-token -R` command (solokeys-docs-10), giving users some control over deletion. However, this is not a first-party, documented retention/deletion feature — it's a generic FIDO2 tool tip buried in a GitHub releases page, with no official SoloKeys documentation on data retention policy or granular per-credential deletion. Missing for 10: native SoloKeys CLI/tool for credential management and wipe, official retention policy documentation, and independent confirmation the wipe command works reliably.

   • [claimed-docs] “Passkeys are replacing passwords across the web. Solo 2 supports the passkey standard — except yours stays on your key. Not their cloud.”
   • [claimed-docs] “You can "wipe" a device using `fido2-token -R`”

   proof ↗⚑ flag

2. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round to SoloKeys Solo 2
   Nitrokey—none0/10

   The evidence pack covers Nitrokey's hardware features (FIDO2, OpenPGP, PIV), its open-source firmware/CLI (nitropy), and community commentary on durability/support, but contains no mention of any telemetry, usage tracking, or opt-out settings for its software (nitropy CLI, firmware update service) or hardware. Since Nitrokey ships software tools that could in principle collect usage data, the axis applies, but there is no evidence either confirming or denying telemetry practices.

   ⚑ flag

   SoloKeys Solo 2~partialclaimed3/10

   Solo 2 is explicitly marketed as working entirely locally ('stays on your key, not their cloud', no software/drivers required), which implies no cloud usage-tracking to opt out of, but there is no explicit telemetry policy, settings, or opt-out control documented for the CLI/companion tooling. missing for 10: explicit telemetry/privacy policy statement, any opt-out toggle or setting, confirmation that the solo2 CLI/companion app sends no usage analytics.

   • [claimed-docs] “Passkeys are replacing passwords across the web. Solo 2 supports the passkey standard — except yours stays on your key. Not their cloud.”
   • [claimed-docs] “No more sticky notes. No more forgotten passwords. No more texts with six digit codes.”
   • [claimed-docs] “Insert your Solo 2 into any USB port. No software or drivers required.”

   proof ↗⚑ flag

Credential management

1. power userList and delete the passkeys stored on my key and know its credential capacity before it fills up

   weight 2 · round drawn
   Nitrokey—none0/10

   While Nitrokey ships FIDO2 support and an official nitropy CLI, the evidence pack contains no documentation or mention of commands/features to list resident passkeys, delete individual credentials, or view credential storage capacity/limits. This is a fair capability to expect from a FIDO2 authenticator, but no evidence confirms it.

   ⚑ flag

   SoloKeys Solo 2—none0/10

   No evidence describes per-passkey listing, deletion, or credential-capacity reporting; the only related CLI ops shown are `solo2 list` (lists connected devices, not credentials) and `fido2-token -R` (wipes the entire key, not selective deletion). Additionally, a runtime probe shows the official CLI is now broken (ImportError against modern fido2 libs), further undermining any credential-management workflow.

   • [github] “solo2 list # list connected devices (alias: solo2 ls)”
   • [claimed-docs] “You can "wipe" a device using `fido2-token -R`”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

Fido2

1. security engineerThe key stores discoverable FIDO2 credentials (resident keys / device-bound passkeys) so users can sign in to WebAuthn services without typing a username

   weight 3 · round to SoloKeys Solo 2
   Nitrokey~partialcommunity6/10

   Docs confirm FIDO2 support and explicitly market 'passwordless login' to Microsoft/Nextcloud (nitrokey-docs-4), which implies discoverable/resident-key credentials, and FIDO2 is listed as a core feature (nitrokey-docs-1, nitrokey-docs-16). However, no documentation explicitly names 'resident keys' or 'discoverable credentials,' and community reports note the Nitrokey 3 has lagged on FIDO2 feature parity with competitors (many features listed as 'planned'), raising doubt about completeness. Missing for 10: explicit resident-key/discoverable-credential documentation, independent hands-on verification of usernameless sign-in working end-to-end.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   SoloKeys Solo 2✓fullclaimed7/10

   Solo 2 is marketed explicitly as a passkey/WebAuthn security key that stores credentials on-device rather than in a cloud, and general FIDO2 passkey support inherently implies discoverable/resident credentials for usernameless sign-in ([solokeys-docs-2], [solokeys-docs-9], [solokeys-gh-1]). Missing for 10: explicit documentation of resident-key storage limits/technical FIDO2 conformance details, and independent hands-on confirmation of a usernameless login flow (only marketing copy corroborates this).

   • [claimed-docs] “Passkeys are replacing passwords across the web. Solo 2 supports the passkey standard — except yours stays on your key. Not their cloud.”
   • [claimed-docs] “No more sticky notes. No more forgotten passwords. No more texts with six digit codes.”
   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”

   proof ↗⚑ flag

2. power userThe key works as a WebAuthn/U2F second factor across the major services I already use — Google, GitHub, Microsoft, password managers

   weight 2 · round drawn
   Nitrokey~partialcommunity6/10

   Docs confirm FIDO2/U2F support and explicitly name Google/Facebook U2F login and Microsoft passwordless login, and general 'Two Factor Authentication' docs exist, but GitHub and password-manager compatibility are never explicitly evidenced. Community reports also note the Nitrokey 3 lagging in feature parity vs. competitors and having 'planned' rather than shipped features, raising some doubt about full protocol coverage. Missing for 10: explicit GitHub WebAuthn/U2F confirmation, password-manager (e.g. Bitwarden/1Password) compatibility evidence, and independent hands-on confirmation across these specific services.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Login to websites (e.g. Google, Facebook) using secure One Time Passwords (OTP), U2F or ordinary static passwords.”
   • [claimed-docs] “Forget your password to log in to Microsoft services (e.g. Office 365) and Nextcloud and use Nitrokey for passwordless login instead.”
   • [claimed-docs] “Two Factor Authentication”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”
   • [community] “My Yubikey 5 NFC rocks. Just works. I ordered a Nitrokey 3C NFC 2 years ago, never heard from them until a week ago where they said they shi…”
   • [community] “I hesitated between both, but the nitrokey 3 has so many things listed as "planned" that I went for a Yubikey (bought a 5a NFC and a 5c NFC)…”

   proof ↗⚑ flag

   SoloKeys Solo 2~partialprobed6/10

   Solo 2 is a standard WebAuthn/FIDO2/U2F device that would work with any relying party supporting those standards (Google, GitHub, Microsoft, many password managers), and vendor docs confirm FIDO2/passkey and U2F-style support plus broad protocol coverage (OATH, PIV, OpenPGP). However there is no explicit first-party or independent testing evidence confirming compatibility with each named service, and a runtime probe shows the companion CLI tooling has bit-rotted with no firmware update in 4 years, raising doubts about ongoing maintenance/compatibility. Missing for 10: explicit per-service (Google/GitHub/Microsoft/password manager) compatibility confirmation, independent hands-on verification across these services, and evidence of active firmware maintenance to keep pace with protocol changes.

   • [claimed-docs] “Passkeys are replacing passwords across the web. Solo 2 supports the passkey standard — except yours stays on your key. Not their cloud.”
   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”
   • [claimed-docs] “When prompted, touch the capacitive sensor on your Solo 2 to confirm.”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): the official Solo CLI has bit-rotted — `uvx --from solo-python solo version` fails with 'Impor…”

   proof ↗⚑ flag

User verification

1. security engineerThe key supports on-device user verification — a FIDO2 PIN or built-in biometric — so a stolen key alone cannot authenticate

   weight 2 · round drawn
   Nitrokey—none0/10

   Evidence confirms Nitrokey devices support FIDO2 and mentions 'Touch Confirmation' (a presence check), but nowhere does it document a FIDO2 PIN or biometric on-device user-verification mechanism that would block use by a mere possessor of a stolen key. Missing for 10: explicit documentation of FIDO2 PIN setup/enforcement, biometric sensor support, or any UV (user verification) flag being satisfied — only touch/presence confirmation is evidenced, which is a different, weaker security property.

   • [claimed-docs] “SSH Keys”
   • [claimed-docs] “Touch Confirmation (Nitrokey 3 only)”
   • [claimed-docs] “The Nitrokey 3 combines the features of previous Nitrokey models: FIDO2, one-time passwords, OpenPGP smart card, Curve25519, password manage…”

   proof ↗⚑ flag

   SoloKeys Solo 2—none0/10

   Evidence only shows a capacitive touch sensor for user presence confirmation (solokeys-docs-1), which is a presence test, not FIDO2 user verification via PIN or biometric. No documentation or community evidence mentions a settable FIDO2 PIN or biometric sensor on Solo 2, so the specific 'stolen key alone cannot authenticate' verification story is unevidenced.

   • [claimed-docs] “When prompted, touch the capacitive sensor on your Solo 2 to confirm.”
   • [github] “It's a USB+NFC device that protects your accounts with passkeys/WebAuthn, and also speaks OATH (TOTP/HOTP), PIV, and OpenPGP.”
   • [claimed-docs] “Everything in Solo 2 plus NFC tap-to-authenticate for compatible Android and iOS devices.”

   proof ↗⚑ flag