[mcpherrinm]

TouchID on macs are another reasonable option.

My employer uses Duo, which supports phone push, yubikeys, or webauthn/touchID in chrome.

I almost always use touch ID. I do have a yubikey and phone push as a backup, but I really want to minimize using my personal device for work (and don't want to carry two phones).

A yubikey is much less obnoxious to carry around than an extra phone.