U2F authentication requires read/write access to USB devices. To
facilitate such access it comes with a devd.conf(5) file, but you
still need to restart devd(8), add the desired users to "u2f" group
and log those out of the current session. For example:
# service devd restart
# pw group mod u2f -m <user>
$ exit
For details, see /usr/local/etc/devd/u2f.conf