If you allow OpenID, users can choose an openid provider that has a hardware authentication option, like Verisign.

Most won't, but it at least is an easy way to provide this option.