At least if you go that route use a biometric authentication mechanism, e.g. YubiKey Bio.