Comment by hart_russell

Also a Yubikey requires you to physically push it to sign. So an attacker needs to have physical access.