Depending on the security needs using hardware based security as a second factor while still requiring some other form of auth is not actually a bad idea.