In your YubiKey SSH client you use the PIV applet with a maximum of RSA2048 when you could’ve used the auth key on the GPG applet for RSA4096. Is NIST compliance something you want to advertise today?
The YubiKey plugin uses the PIV applet with P-256 keys, not RSA. FIPS 140 compliance is not a goal.