I'm just guessing, but KPXC could emulate a USB device, or - if such things exist - register itself as a security key provider with the operating system

because using a yubikey instead isn't that much more in terms of key-to-browser pipeline - the browser just requests the key from a providing entity