I have multiple physical keys for u2f. Including one that is set up on our servers that requires physical insertion and activation before a user can login or run sudo.