Reproduction steps:

1. Set a short TTL for your user (like 1 minute) and require a hardware key.
2. Log in.
3. Start a connection to a kube proxy.
4. After your cert expires, run a command like kubectl version. You will be prompted to log in again.
5. Try to log in. The dialog (in my case a passwordless dialog) will freeze on the last step:

The problem happens because both Relogin and AskPIN/Touch events try to acquire the same importantModalSemaphore. Because relogin is still in progress, we can't show the hardware key dialog. This in turn doesn't allow us to complete the login :(