Keys created on _some_ Yubikeys (it's easy enough to check).

I had an affected YubiKey -- Yubico shipped out a replacement immediately. It's inconvenient if you have an old YubiKey, but the replacement process is simple.

Additionally, you can always generate GPG keys on your machine, transfer them to the YubiKey, and then delete the keys from the local machine. It depends if that's an acceptable exposure for your threat model, but for me, having the keys locally for a couple minutes is fine.

I generated on livecd, and exported it to multiple yubikeys + backup.

That way I don't have deal with different subkeys and other complications that just makes everything hard to understand :)