It seems like more of the implementation might need to be in sshlib. If a test can't be written for it then the boundary between library and user of the library may not be in the right place.

Your criteria for the library boundary seem reasonable to me, so I wrote unit tests since the change is fairly simple. However, moving this logic to the ConnectBot side will mess up the library interface.
​Maybe we should also move some parts of the actual hardware key communication to the sshlib side to isolate the complex key handling from the ConnectBot side, but this will require hardware key unit tests without the physical key. I found that YubiKey seems to provide a test suite for this. However, we should check whether the test covers our use case first. So, I will add that to the ConnectBot side first, then plan to move it to sshlib as another PR. Possibly, because of its complexity, moving that can be a difficult task.