I'm pretty sure that you can use something like a YubiKey as a PKCS#11 certificate store, if the issue is just the card reader form factor.
kagis
Yeah:
https://developers.yubico.com/yubico-piv-tool/YKCS11/
This is a PKCS#11 module that allows external applications to communicate with the PIV application running on a YubiKey.