After creating the account, and a member tries to login without Yubikey. Lock the member out. This can be set in the siteconfig. It should be based on the general time it takes for Yubico to deliver the keys, and can be overridden by unchecking the Yubikey login required checkbox in security. The time will then be reset, or set to an amount of extra days. I'm not sure about that yet.
After creating the account, and a member tries to login without Yubikey. Lock the member out. This can be set in the siteconfig. It should be based on the general time it takes for Yubico to deliver the keys, and can be overridden by unchecking the Yubikey login required checkbox in security. The time will then be reset, or set to an amount of extra days. I'm not sure about that yet.