[aroch]

You can use yubi's PAM modules in conjunction with SSH PAM auth, no need to patch OpenSSH.

https://developers.yubico.com/yubico-pam/

[nickik]

For Yubikey OTP, not U2F.