The crypto involved in U2F is extremely hard to do in an AVR. There are issues with sources of randomness (I'm currently playing with implementing entropy via Watchdog Timer jitter on the ATTiny85, which appears suitably random but is slow), and the capabilities of the devices themselves to produce output at reasonable speeds.

A slower Cortex M0 might not be sufficient to get decent speeds, but I suspect an M3, something like an AT91 could do the job.