You can set this up with `pass` and a Yubikey: https://www.palkeo.com/en/blog/perfect-password-manager.html