security.pam.ussh.control

This option sets pam "control". If you want to have multi factor authentication, use "required". If you want to use the SSH certificate instead of the regular password, use "sufficient".

Read pam.conf(5) for better understanding of this option.