> Think of it as of an advanced yubikey.

A cheap Android phone is pretty much the opposite of a Yubikey, in terms of trusted computing base and attack surface.