Wow neat. I've been using yubico-pam module for a while now, to enforce hardware auth for SSH _without clientside config_ (yubikeys can send a OTP by acting as

Wow neat. I've been using yubico-pam module for a while now, to enforce hardware auth for SSH _without clientside config_ (yubikeys can send a OTP by acting as a keyboard). U2F support would achieve this without the extra server PAM config unique to yubico and remove reliance on a separate auth server - not to mention remove reliance on these particular type of keys that support their OTP which are pricey.