The issue is that operators can just curate a whitelist of authenticators they like. They could opt to not allow Yubikeys if they wanted.