FWIW, I would be inclined to standardise on PIV/CAC devices (i.e., smart cards), for which there are standard USB readers and drivers and protocols. You can get started with YubiKeys because they're relatively reliable, if a little expensive, and they have good support for PIV/CAC -- but if you stick to what smart cards can generically achieve you won't get shafted by only having a single supplier in the future when Yubico inevitably becomes less attractive for some reason or other.