[Leace]

If you use Yubikey with touch-to-use enabled that'll be basically what you're asking - each authentication will require touching the token.

[haasted]

I just enabled that after seeing this incident.

For people in the same boat, it can be done trivially using the YubiKey Manager CLI: https://developers.yubico.com/yubikey-manager/