I haven't been following what these are or why they're flawed. It looks to me like they're taking Two Factor Auth, and removing one of the factors (the password). Now all you need is a device? If the device is lost or itself compromised, isn't that still a single point of failure?

I keep saying this myself. I feel bad because there is a real problem they are solving (phishing) but ultimately it is an overly technical solution to an extremely human problem. They're only as strong as their weakest recovery method and the inability for the average user to understand the technical implementation and ramifications takes power away from a personally held secret (problematic as that may be) and shifts it towards more platformization.

It all just makes me vaguely uncomfortable in ways I have a problem fully articulating.

Isn't the main issue moving them and that was effectively solved this week?

Assuming it's £600/day total (which would make more sense than per person), that's a bit over £200k/yr. It isn't that much taken relatively, but it's still money that can be spent somewhere better, and it's enough to make a noticeable impact depending on how it's used.