Would you happen to know what the rule is on Yubikeys and the like? I assume if it's PIN-protected, it counts as a password but what if it's just set up for tap-to-unlock?
I extrapolated this as anything that is in the mind (PIN, password, some secret) cannot be demanded, while anything outside of the mind, biometrics, geolocation, physical object (key) can.
Again, I am just a hairless monkey smashing rocks together. Consult experts.