It's a shame so few registrars support hardware tokens [1] since those would be better still.

[1] https://twofactorauth.org/#domains