Yeah but then it will only use the certificate on the yubikey and not ask for a password so we’re back to 1FA