A stolen hardware key is likely to be noticed though.

Perhaps a better approach regardless of how it's stored is notification of use?