Start but not claiming it's yubikey-based, and instead phrase your product in terms of what category of dependency it has. You built a product that's secured by

Start but not claiming it's yubikey-based, and instead phrase your product in terms of what category of dependency it has. You built a product that's secured by means of a username, password, and hardware authentication code. Yubikeys are an obvious example of the kind of hardware authenticator that works with, but that's just an example. At no point is your product locked into yubikey as authenticator. Even if it's the hardware authenticator your product currently works with. Don't market it on current specifics; anyone not using a yubikey (personally or organisationally) will dismiss your product and never look at it again if you tie it to one specific third party vendor.