If you don't want your semi-public (ie payed for) WPA2 key to be compromised, use 802.1x. Then you can use whatever you want for authentication, including time based tokens.