Comment by comboy

The point is that they don't have to pinky promise. It's as if you said yubikey pinky promises it won't share your private key.

I think it's actually a very good approach. Obviously depends on actual implementation details, but the premise is good.