Did the recent Edge/Chrome updates break Yubikey sign-ins?

I'm curious if anyone else out there has a scenario like mine and can point me to more information. Or maybe you have this issue and what I know so far can help.

We're using Yubikeys as smartcards (PIV) to authenticate to our Level 0/1 servers and devices. One such device is a Palo Alto firewall, which is set up with Kerberos SSO. If we pointed Edge at its web portal, it would prompt us to enter our Yubikey PIN and then we could authenticate on the portal. This stopped working yesterday.

Now, the browser prompts for a username/password, which we can close without entry. Then the Palo web portal asks for credentials, and we can enter those with a single-factor break glass account.

Today, I discovered that I can use the "Internet Properties" settings in Windows (from IE days) to establish the portal as a trusted site and set the "Custom Level" to "Automatic logon with current user name as password." If I'm signed in to Windows as the necessary account I'm granted access to the portal without even entering the Yubikey PIN.

I'd like to return to old functionality, if possible, because I'm sometimes signed into Windows with a different account and holding the Yubikey and knowing the PIN is sufficient for us to allow access to the portal.

Does anyone have a link to possible announced change like this, and does anyone have a sense how I might get things working the way they were?

EDIT: I remain suspicious the issue is related to Server 2019 updates, since one of our two DCs received the update between the last successful sign-in and the broken behavior. But only one of them.

EDIT2: There was also an update to Edge that ran between the last successful and first failed login. That's my prime suspect for the change in behavior.