Is it considered good practice to create the key on the yubi and not have a backup? Or alternatively a master key to sign the key on the yubi so you can create a new subkey if you lose the yubi?
You can use multiple devices to generate multiple keys to give you persistent access in case a device fails or is lost. Software generally accommodates multiple (public) keys per client for this reason.
With an SSH CA, the server ultimately trusts the CA key, and client keys are used for authentication via the client certificates. I think you can use Yubikeys and relatively inexpensive HSMs (eg. Nitrokeys) for this.
https://framkant.org/2016/10/use-a-smart-card-or-hsm-to-secu...
One way to achieve it is by generating it on a RAM disk and throwing it away, once it's on both Yubikeys. I blogged about it here https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-sec... (for macOS)