Very nice! I hadn't thought of a hardware token, but that does sound very alluring!
Do you have any particular hardware ones you can recommend? :)
idk ... there are lots of companies which offer them ... it depends on your use-case.
in my experience:
for simple account-security - eg. github, google, microsoft, etc. - even older ones work great.
for other purposes you have to look at the feature-list of specific tokens, if they support the necessary security-protocol for your use-case.
personally i have various older & newer models of the companies yubikey - 4 & 5 - and gotrust - idem :)
cheers t.