yep. What I did in the past, back when yubikey first came out, was I added a PAM module to check the presence of the yubikey. It's almost comically stupid since

yep. What I did in the past, back when yubikey first came out, was I added a PAM module to check the presence of the yubikey. It's almost comically stupid since it just checks that the key is inserted with the correct serial number. But you'd need root to see what the number is (to emulate it with a fake usb device, I guess), and to get sudo you'd need the key inserted. I WFH so I'd just leave the key inserted for passwordless sudo all the time. But if I needed to step out, just grab the yubikey and go.