That's not true. You can use AWS SSO with the CLI/SDKs (therefore including stuff like Terraform) with webauthn.

It briefly pops you out to a browser to authenticate and caches a short lived token locally

If you use federated auth, then you can do whatever you want; 10 UDF keys and a video of a special dance if you so desire

There's AssumeRoleWithSAML so you can use any IdP

There's tools like aws-okta that can advantage of that to supply short lived credentials which require 2FA

You could also write a service that requires whatever authentication you want and returns the results of STS AssumeRole

I really want to like U2F, but it’s use cases seem so limited.