Feature Request: `*-sk` keys supporting PIV-like policies

Now that The Bastion supports `*-sk` keys, it would be nice to have PIV-like policies available to limit keys to an account to PIV/SK/FIDO2, grace periods, etc. It could potentially utilize [`PubkeyAuthOptions`](https://man.openbsd.org/sshd_config#PubkeyAuthOptions) in some capacity.

Please close this if it seems like a stinker of an idea :).