Turns out we already do! When setting up 2FA, select WebAuthN and create a label for your device. When prompted, follow directions on your device.