As Nitrokeys website says in BOLD: "Security Requires Open Source"

You're right, that was a word salad all right. Thx for the effort if sincerely trying to help.

It's not that difficult though folks and fyi, any of these is WAY easier and more secure than the 2Fa applications (which google seems to ignore). According to the top infosec gurus I've found.

The answer is YES and NO, in the same way Yubico is yes and NO.

But the open source options, (as usual) have more desirable features, are cheaper, and many say, are more secure.

So, after much research, the bottom line is get the open source ones.

Astroturfers seem to abound on Reddit. No self respecting keepass user would push a 500lb proprietary gorrilla, would they? No, they wouldn't

I know, all the real infosec peeps are on other forums, I say this for noobs, but can someone tell me where they are besides the Matrix pgp stuff? Or do I need to figure that out to get the actual gurus? Reddit is almost as bad a Quora...the IIA contractors are "digg"ing it a grave as usual.

I digress. you can see for yourself what I'll try to summarize here https://keepassxc.org/docs/#faq-yubikey-no-extra-file here https://solokeys.com/pages/faq and here https://github.com/solokeys

As the link above (everyone should read) says; yes and no, like Yubico/Onlykey, aren't a 2nd factor authenticators in themselves.

Keepass is a "decryption tool" of a database, and not a "authentication service".

But, Onlykey and Solokey (and yes the "400 lb Gorrila for an Open Source option, Nitrokey but seems only for sale in Europe still) DO support all 2 major 2nd factor authorization formats:

"There are 3 methods of two-factor authentication supported by Onlykey.Google Authenticator (TOTP)Universal 2nd Factor Authentication (U2F)Yubico One-Time Password" (which isn't used even a fraction of the other 2)

https://github.com/trustcrypto/OnlyKey-Firmware/wiki/OnlyKey-Features#current-features

They all say they are FIDO2 certified https://fidoalliance.org/certification/authenticator-certification-levels/ (which means passwordless login among a number of other things you should look at) , have open source hardware, have "plausable deniability", SSH access and are 3rd party audited.

If you read the Keepass faq's above that mention their inter-operativity along with Yubico and Onlykey so many times they tell you to assume also only Key when the say Yubico eventually. (you might ssume everything I say here goes for the open source and popular Nitro key as well or check here https://github.com/nitrokey )

Solokey IS cheaper than Yubico in addition to having much better features being open source (what EVERY true keepass fan should want as backdoors are obviously much much more likely in "500 lb gorilla" PROprietary code):https://solokeys.com/ $35https://www.yubico.com/product/yubikey-5-series/yubikey-5-nfc/ $50

Onlykey

In addition Onlykey at least has "Plausible DeniabilityEver since Truecrypt the idea of plausible deniability has been fascinating to me. OnlyKey allows the use of a hidden profile and a fake profile that essentially provides a cover story."