If the vault requires a hardware key and master password to access the encrypted password and token, would you still describe it as single-factor authentication?