I haven't done much with luks since 2021 so I have completely missed the support of luks2 with clevis. This should allow me to store the luks2 data in the luks2 header where it belongs. This is available in debian/ubuntu so I don't have keep hacking it into the system--unfortunately the kubuntu installer is full of bugs preventing clean install of luks2 encrypted root (we do other hackish stuff to make that work).
sudo apt-get install clevis clevis-luks clevis-initramfs clevis-tpm2
sudo clevis luks bind -d /dev/your-device yubikey '{"slot":2}'
sudo update-initramfs -u -k all
That did not work. Seems that fido2 support is missing from all of my components on Kubuntu 25.10. maybe the next release will be better? This makes clevis not supportable for encrypted root unlock with smartcard on Kubuntu at this time.