Why does Mt Gox disallow YubiKeys purchased direct from Yubikey.com? I have several Yubikeys and would like to use one or more with MtGox.... however it seems that I can only use keys purchased from Mt Gox on their site.


Why did Mt Gox choose to implement security this way? 
Suppose I'm creating my own secure website based on Yubikey.. what are the conditions that I would choose to implement a "closed" system like this (and not allow other Yubikeys)?


I asked Mt Gox support this very question and all they told me was:


  Hello, Thank you for the email. Please note that the yubikeys
  has to be pre-configured with our systems, so unfortunately it is not
  possible to add yubikeys that are purchased outside. Thanks, MtGox.com
  Team


... so I'm hoping to get a better understanding on why this choice was made.
Properties of a yubikey:


A yubikey contains a secret symmetric key.
Knowledge of this key allows emulating that yubikey.
The server needs to know that key.

  The YubiKey AES Key information can never be extracted from a YubiKey device – only programmed to it



So Mt.Gox's insistence on sending the key to you ensures several important properties:


You're not tempted to use the same key to authenticate to other websites, which would allow those websites to break into your Mt.Gox account
You don't need to send the key to the Mt.Gox server through your potentially insecure computer
Nobody but Mt.Gox knows the key stored in your yubikey


So pre-programming yubikeys and sending them to you only after the key was programmed into the device rules out several possible threats, and thus seems reasonable risk management.