Optionally require PIN code when using hardware key / security key (FIDO2 / "passkey"-2FA)

Besides, the feature that you request is already available, if you just acquire a modern Yubikey (Firmware version 5.7 or higher), and enable the alwaysUV flag.

While you should be able to set the flag to “on”, that doesn’t neccesarily mean that it will always work. From what I can tell, the flag might not be nativly supported on certain systems, but perhaps more importantly, if used on a website that supports WebAuthn but does not request UV, the request might instead be blocked (on Windows 10 specifically).

*On Windows 10, security keys enabled with “Require always UV” will work with Okta or Entra ID. However, other
websites supporting WebAuthn that do not request user verification, might block the user from logging in.

YubiEnroll User Guide