you could replace google authenticator with a yubikey