It seems odd to focus on physical tokens, when this could just as easily be built into the Browser/OS.

Sure, you also get some additional resistance when your machine is hacked, but it's pretty marginal compared to the phishing benefit.