h4k3t It's hard to say and depends on what you need most. Some tips:
- e.g. firmware from Signet HC and Solo 1|Somu tiny was not further developed after the Kickstarter campaign. I'm afraid the same thing with solo2.
- Therefore, I would only recommend Solo Hacker for developers & makers from Solokey.
- (All manufacturers) NFC transmits only a small voltage and no time. TOTP therefore does not work over NFC and neither does strong de/encryption (or rather the chips for it).
- OnlyKey is the only one I know of that has a device hardware PIN + self-destruction. (Adjustable: Config only or complete firmware.)
- With the OnlyKey-Duo, the 6 numbers are emulated with 3 pins. (left, right or both & short press or long press) This is fiddly. Optional conf: Entering the PIN via the device software is insecure. (my opinion)
- For setting FIDO2 PIN you need one-time the CLI utility on all keys. (Yubi, Nitro, Only) The rest of the config can also be easily done via the GUI.
- FIDO2/WebAuthn, U2F works out of the box for all keys. OnlyKey and NitroKey3 can do a hell of a lot more. Crypto is hard, it takes time to understand all the options. But not everyone needs all the options.
- Onlykey does not have a Smart card or OpenPGP card. OpenPGP support works via WebCrypt or with the trezor gpg agent.
- Onlykey is just a small Kickstarter side project from CryptoTrust, but it is the only key I know whose firmware is constantly being developed further.
- Nitrokey3 is just new, firmware (in the memory-safe programming language Rust) can't do everything yet e.g. OpenPGP smart card is experimental. But Nitrokey has a large development team + Solokeys and Nitrokey are together developing Trussed.
- If you also need a hardware wallet for cryptocurrencies, a Trezor could also be interesting. He also has FIDO2/WebAuthn, U2F, Password Manager, OpenPGP support.
- 2FA accesses should have at least one backup. I have 2 or more hardware keys + OTP app for each account. Plus backup of OTP app + some keys.
- NitroKey also sells Pixels with GrapheneOS and wants or has?
¯\_(ツ)_/¯ support GraphenOS.
- I've important accounts or SSH keys only on Onlykey. They are safe there if they are lost or from officials when crossing the border.
- I often carry laptops in my backpack. That's why I have a Nitrokey 3A Mini or Somu tiny in every laptop. For everyday FIDO2/WebAuthn, U2F accounts.
If you can afford 2 keys, I would recommend an Onlykey and a Nitrokey3. Unfortunately, both are often sold out. Since you can back up the keys, you don't have to buy them in pairs. If one is broken or lost, you can buy a new one later and import the backup. Then you can try out which keys you like. For example, some people don't like the USB-A Yubi- and Onlykeys. Onlykeys, Nitrokeys, Solokeys or Tresor can all be flashed with new firmware. So you can give them away if you don't like them. All 4 are open source with partially overlapping (forking, PR) development on GitHub.
Onlykey shipping from US to Germany/Europe is expensive. If there is a Kickstarter campaign or you can pay with bought cheaply crypto, then I always order 2-3 pieces.
The perfect key for me would be a NitroKey3 with hardware PIN. It could do everything I need (If the firmware is stable at some point. Month? Years?) and would be easy for me to buy in Germany.