I think software token that you setup with qr or password from page is still "something you know (but it was too long to remember)", not "something you have (like a private key that that was generated on and never left your security key)"