While having a YK neo with all the features, I prefer the simple FIDO security key. Everything you could want apart from legacy/special use cases can be achieved with fido.
websites -> fido/u2f
ssh -> native fido support in ssh-keygen
login -> fido2 for windows, libpam-u2f for linux
luks encryption -> systemd-cryptenroll
websites -> fido/u2f ssh -> native fido support in ssh-keygen login -> fido2 for windows, libpam-u2f for linux luks encryption -> systemd-cryptenroll