[glennos]

I hadn't thought about the security of being a physical token. Feels like you could do 2FA using someone's email (or similar) to protect against some scenarios, but take the point that someone having to steal something physical changes the attack surface.