Or in a Yubikey and set the touch-required mechanism (light in the key will blink when it needs a touch to continue the auth).