The key fob (or equivalent application on one's phone) is a better option compared to email/SMS based 2FA since the latter is not secure [1] [2]). The latter is still a lot like the half-baked security measures I mentioned in my earlier post.

I still think having certificate/private key imported into my browser as a one-time (or periodic) task more convenient compared to having to use a key fob or soft token from a phone app everytime I have to log in.

[1] https://techcrunch.com/2016/07/25/nist-declares-the-age-of-s...

[2] It's a general problem of people using the same password for one's email account or cell phone service account and their online bank account