I would much rather we just handed everybody an RSA token.

Dead simple… Works off-line… Requires no account or personal infra to use…

… And as a bonus I already have a nice workflow where a WebCam is pointed at my token sitting on my desk.

I kid.

Or do I … ?