I vote for allowing at least hardware keys as a single factor. I use Trezor and the private key is securely stored in the device's Secure Element and cannot be read from it in any way. In conjunction with public key cryptography it is a much more secure solution than for example usernames and...