age-yubikey-pgp VS FIDO2Applet

Also there is age-yubikey-pgp which uses dage to allow you to use X25519 for file encryption/decryption https://github.com/Producement/age-yubikey-pgp

We created a (Flutter wrapper for Yubikit libraries)[https://github.com/Producement/yubikit_flutter] and (a plugin for age-encryption)[https://github.com/Producement/age-yubikey-pgp] to decrypt the files if for some reason the app does not work anymore as well, they are both open source and available for everyone to use.

I believe the Solokey meets your definition. The hardware schematics are open, as is the software running on it.

The Precursor is also open hardware and software.

If you trust any smartcard at all running a Javacard-compatible operating system, there's also https://github.com/BryanJacobs/FIDO2Applet .

And of course if you're truly paranoid you can get a FPGA and implement a hardware security key on that. The overall security posture would likely be weaker, but you could be confident, hopefully, that nobody has put some kind of backdoor into the hardware you designed yourself to run atop a generic array of logic gates.

If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too.

A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).