For whatever reason, this resulted in me being prompted to first type my password, then also authenticate with Touch ID.
Mine looks like
```
auth sufficient pam_smartcard.so
auth sufficient pam_tid.so
auth required pam_opendirectory.so
account required pam_permit.so
...
```