But then where do you put the hardware keys?

Presumably you would need to obtain all three keys every time you register a new user account on a website.