As tomxor said elsewhere here, though, batch attestation allows you or relying parties to check that the key is a “real” Yubico key.
I wonder where it would make sense though?
1. WebAuthn (current spec) is also implemented by Android, iOS macOS and Windows 10/11 (natively); that makes your device a possible "passwordless factor holder". You then essentially tie your authentication with your device passcode and/or biometric ID, similar to what a password manager would do, except there's no password to steal.
2. YubiKey BIO supports biometric authentication (I presume with on-board fingerprint verification) to use the device's keys. So it's essentially a biometric-protected private key.
3. IIRC some hardware crypto wallets can act as WebAuthn devices and display the website domain when asking you to touch it. Maybe they support passcode protection?
4. Even if you were to use a "raw" WebAuthn key stored on your computer (on TPM, Secure Enclave, or even filesystem) -- if you protect it with a password, you essentially have pubkey authentication with a second factor of password.
To be clear: Things you can do with FIDO2 include:
* Just a "second factor". The authenticator has no memory of who it is, RPs (Relying Parties, e.g. web sites) basically provide prompts, which they derive from looking up a username you entered. The RP says if this is tialaramex, you'll recognise this arbitrary ID you gave me when enrolling and sign this freshness proof. The authenticator checks if it recognises the ID and if so retrieves the private key and signs the message, voila.
* "Passwordless". The authenticator is behaving the same, but now the RP is only taking a username first, there may be no second factor. This is more secure than most passwords today, but is only a single factor.
* "Usernameless". The authenticator now needs to remember every RP it has enrolled with, because the RP won't prompt it. Given the name of an RP (e.g. "news.ycombinator.com" the authenticator needs to replay the ID it gave when enrolling, and sign a freshness proof "I'm still, uh, tialaramex apparently".
In a corporate environment, or perhaps banking, you can insist (via a thing called "Attestation") that the authenticator provides proof it is a real authenticator made by, e.g. Yubico and based on that claim trust it to do multi-factor authentication itself.
Yubico's cheaper products do PIN auth, so you touch the sensor and type in say, "MyFuckingSecret" as PIN, the PIN is not sent to the Relying Party, they just get a message saying "Here's proof I'm that Yubico Yubikey which enrolled, and I say this is still the same human who enrolled me, I checked using a method my vendor says is suitable".
Yubico's most expensive product, and the Google Pixel series, and some iPhones, use a fingerprint as their additional factor. Again though, the authenticator just says "I promise I checked, this is who made me, trust or don't" it doesn't send fingerprints anywhere.