Yes, FIDO key to Dom0 (F37). But crypttab has to be precisely defined (disk nomenclature) or the machine will fall to dracut. I tested this first on Fedora alone.
@Industrial is saying he just plugs in a yubi at install if I am reading him correctly. Then the reason it is not working is because nothing has been done to bind the key to LUKS. USB keyboard is another topic. Except if you are thinking about how Dom0 can connect to USB (security key i/o). Dom0 can connect to networking pci for secure updates (no need to involve the dedicated qube for ether or wifi module pci) and templates so it must be able to access USB in a secure way (might require development).
There is also a GRUB-ykchalresp method (which depends on the type of your Yubikey) HMAC secrets or FIDO? There are different tokens and slots. The topic is complex.
This method looks easier but so does everything until you try to implement it. The cryttab-FIDO method was not at all as simple as it is presented. How step 2 moves to step 3 for the GRUB-ykchalresp method is unclear.
- In work: Generate a yubikey passcode (ykchalresp -2 mypassword)
- In dom0: Add the passcode to luks. (sudo cryptsetup luksAddKey /dev/nvme0n1p3)