You can use it as a second factor by configuring the server to require both password & key with the "AuthenticationMethods" directive

You can also configure it to require public key + U2F by specifying pubkey auth twice which will require two different pub keys but I suppose that would depend on the user having only 1 regular pubkey and one U2F pubkey in their authorized_keys file

https://man.openbsd.org/sshd_config#AuthenticationMethods