Modern Yubikeys require AES-192 for their default admin keys, which means we need a version of pivy that supports them. Just-announced v0.12.0 should do the trick.
Because it’s been a while since kbmd’s last pivy update ( OS-8406 ), there may be landmines waiting for us.