Can you prove, for the most common disk encryption programs like Veracrypt or LUKS/dmcrypt, that a second factor like a yubikey or a keyfile on a USB disk is required? If this is not the case is there anything the end user could do? Like some configuration options?
In some countries there are key disclosure laws and in case plausible deniability would be possible you could just claim the dog ate it. They probably still won't believe you, but anyways.
It is impossible to tell if a keyfile is required. There is no difference, from an attacker's perspective, between being unable to decrypt a drive because they are exactly one letter off in the password, and because they are missing an entire keyfile. All they know is that they are unable to decrypt it. In fact, if I were to give you a hard drive that has truly random (very high entropy at 8 bits per byte) data on it, you would be unable to tell if I had encrypted it with a password, with a password and a keyfile, or even if it is not encrypted at all and was just wiped.
When you use a keyfile, it is mixed with the password. This is then is used to derive the key that decrypts the header to retrieve the master key. A keyfile can thus be thought of as an extension of your password.
