We should have support for the attestation certificate feature in gpg-card. With that and a FIPS version, HARICA will allow the use of a Yubikey.