PAM was invented for scenarios like that. AFAICT logind uses PAM no matter what graphics server are you running.

So this likely works under Wayland and X equally, provided the right yubikey: https://adl1995.github.io/passwordless-logins-with-yubikey.h...