Forget 2FA - yubikeys can be actual full key generation/storage for a GPG key in smartcard mode, and then via gpg-agent those can be used for ssh. (gpg-agent replaces ssh-agent.)
My ssh keys never leave the yubikey.
I have a different dedicated yubikey in each computer, with its own unique key, and a stolen key is useless without its unlock PIN.
My ssh keys never leave the yubikey.
I have a different dedicated yubikey in each computer, with its own unique key, and a stolen key is useless without its unlock PIN.