it's incredibly surprising that this isn't the top answer.
even a hardware token like a yubikey or CAC has a bunch of problems and they are by far the "best" way to do something like this.
even a hardware token like a yubikey or CAC has a bunch of problems and they are by far the "best" way to do something like this.