I just finished setting up a LUKS encrypted system that is unlocked using a FIDO2 hardware token following this blog post. However, at home I usually leave the hardware token plugged in and I only remove it when traveling. So if someone were to steal the laptop together with the plugged-in hardware token they could easily boot the laptop and decrypt the disk.
To remedy this I'd like to use 2FA with both a password and the hardware token, but so far I only found solutions using a password + HMAC-SHA1 by using the password as the challenge and storing the generated hash as the actual password in LUKS, so this does not generalize to FIDO2. Is there a way to get 2FA working with FIDO2, too?