It's true. You can only set one 2FA factor on an IAM account. As a work around, I ended up making myself two IAM accounts: one tied to primary Yubikey and another to my backup. Certainly not ideal.