Luckily I wrote down the steps I took. Based on this, but the original seems to be gone now: https://nicluo.com/projects/secure-your-mac-with-yubico-u2f-...

  brew install pam-u2f
  mkdir -p ~/.config/Yubico/
  pamu2fcfg > ~/.config/Yubico/u2f_keys
  <Press the U2f device>
  cat ~/.config/Yubico/u2f_keys # should output <your username>:<really long hash>

  In /etc/pam.d/screensaver 
  Add to the top:
  auth       sufficient     pam_u2f.so

  In /etc/pam.d/authorization
  Add to the top:
  auth       sufficient     pam_u2f.so