rsa pub key authentication when AAA is enabled

Hello,

we usually log in to our BIG IP with TACACs, working fine, now we'd like to have a special user, who should authenticate with rsa pub key.

question: when I create a user, I can not define a password, I guess because of the AAA-Config, right?

So I fear, this would only work, if we disable TACACS.

If we configure the root-user with rsa pub key, there's still asking for Password.

has anyone such a combination?