As far as I understood the U2F standard, the dongles need a FIDO-issued manufacturer key. Do sites accepting U2F just not check that the corresponding signature is present?