Bitwarden itself allows you to require a Yubikey for each credential retrieval. I'm not sure how that would differ from having the Yubikey itself be the credential, from an attack surface standpoint.