> Part of the original U2f Spec was that the TLS session State could be hashed and included as part of the client signature, effectively making MITM impossible.
This turns out to have the usual deployment hiccup, Middleboxes. In this case, at least, they've got some sort of consent, the user agent is agreeing to trust this middlebox which is not, in fact, the host it wanted to talk to. But it necessarily blows up export of session identifiers which was needed to make this U2F feature work.
The session between Alice and her BigCorp middlebox, and the session between the BigCorp middlebox and Bob's server are two different sessions (if you try to make it "one session" you don't have working middleboxes unless clients and servers only know TLS 1.2 or earlier), so, this shows up as MITM.
Which makes sense, the goal is to ensure MITM is impossible, these consensual Middleboxes are MITM, so it makes them impossible. But as a practical technology you can't deploy it because ordinary Joe User works at some company using such middleboxes and now their U2F sign-in doesn't work.