There are three ways we determine if use of private key is enabled:

-Cluster config: this setting won't render the login form,
it will just direct user to login with other supported methods
- 'privateKeyPolicyEnabled' flag: only returned with a 200 for resets
and invites. This flag was required so that we can additionally render
recovery codes if any (only for Teleport Cloud)
- Checking if the error returned contains the backend hard coded
keywords ('hardware_key' or 'hardware_key_touch'). Role configs
will require an attempt (either logging in or assuming an access request)
before the backend checks if this user requires use of private keys.