This is the way I config PAM to authenticate with my USB keys in NetBSD.

I type a password to decrypt the disk, and that’s it.

No passwords to log-in, unlock the screen or run doas. Only the key.