Onlykey. It’s u2f. And has up to 12 or 24 depending on how you setup username password combinations. It’s got a physical pin required and you can set what happens on 6 failed attempts. Like nuke it’s own firmware and (quantum proof encrypted alg) password and keystore. It requires no software on machine (after setup) so you can use it on machines you don’t own and don’t need to install middleware (I’m looking at you nitrokey) If you use Linux you can use it as a ssh private key and login method requiring challenge response (via its pin pad) (windows support for it is middleware to do this is …not easy). It’s a true one way write… you add a password in all you can do is overwrite never read from it. https://onlykey.io/. Ive been using it my corporate IT day to day for 3 years.

The Dresden Files 10000% and iron druid.