I prefer yubikey which you can also use to protect TOTP authenticator