I thought it might have been because I enrolled an old U2F key years ago, but no looks like anyone with even a new yubikey is locked out. What a mess.