YubiKeys support cli access with the benefit of being hardware backed, and optionally requiring a physical touch:

  $ ykman oath accounts code <slot>
  Touch your YubiKey...