I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not enumerable because they could be used as super cookies, and that could have negative consequences for privacy. This was discussed on the WebCrypto list a while back, so its not new news. The leap is then usually made that its bad in all cases (which it often is).
(As a counter example to "it is always bad", I usually "don't care" about all the bug trackers I am subscribed to. If I can use one public key for all of them to authenticate, then great.)
WebCrypto is essentially a software layer, and it has infinite number of keys (some hand waiving). I then started thinking about my Yubikey... A Yubikey has finite space, so it only has a limited number of keys.
How many public keys can a Yubikey generate and hold?
How does a YubiKey protect privacy given organizations (origins) can collude and compare public keys registered with them?
(It wouldn't surprise me if a government or one of its authorized agents or partners started collecting the public keys and made them searchable in a database, much like Little Black Blox does for private keys).