Thanks for that link. I see further down that PKCS#11 is supported: > Takes an RFC 7512 PKCS#11 URI referencing a security token (e.g. YubiKey or PIV smartcar

Thanks for that link. I see further down that PKCS#11 is supported: > Takes an RFC 7512 PKCS#11 URI referencing a security token (e.g. YubiKey or PIV smartcard) that shall be able to unlock the user account. The security token URI should reference a security token with exactly one pair of X.509 certificate and private key. A random secret key is then generated, encrypted with the public key of the X.509 certificate, and stored as part of the user record. At login time it is decrypted with the PKCS#11 module and then used to unlock the account and associated resources. See below for an example how to set up authentication with security token. Key hierarchy management can probably be delegated to an external system.