I'd use a pair of yubikeys but that's just because I already have them. and I say pair cuz I don't want to rely on a single yubikey that could get lost or stolen or damaged

also I would want there to still be a password required, not just plugging in a hardware token (tho this may be implied)