Yesterday, Google announced yet another Security Key to be used for two-factor authentication (2FA, sometimes 2-step verification, 2SV) for Google's services. This one is built directly into Android 7+ so you may already have it in your pocket. It uses Bluetooth (but pairing isn't required) and currently works only in Chrome and Chromium-based browsers – Google says it's a beta version. And that's basically all we know about it. I use 2FA where possible, I recommend using it whenever possible so I just had to try it.
“The developer was using the same email and password combination on GitHub.” What can go wrong? Hell of a lot can go wrong.