The Yubikey PIV/X509 applet can be used for SSH (see [0]). Their link doesn't explain this but that key can be used as a CA instead of as a straight SSH key if you want. eg to add the CA to your authorized_keys files, generate a throwaway key, sign that with the CA and add it to your ssh-agent:

  ssh-keygen -D opensc-pkcs11.so -e > cert-on-piv.ssh
  ( echo -n "cert-authority "; cat cert-on-piv.ssh ) >> ~/.ssh/authorized_keys
  name="temp-$(date +%Y%m%d-%H%M)"
  ssh-keygen -q -N '' -C "${name}" -t rsa-sha2-256 -f ${name}
  ssh-keygen -t rsa-sha2-256 -s cert-on-piv.ssh -D opensc-pkcs11.so -V -1d:+1d -I ${name} ${name}.pub
  ssh-add -t 1d ${name}
  rm -f ${name} ${name}.pub ${name}-cert.pub

[0] https://developers.yubico.com/PIV/Guides/PIV_Walk-Through.ht...