Seems like the only real solution would be to have a dedicated device just for 2fa