Google already solved this problem with U2F (FIDO Alliance) tokens.  They're about €15 and the protocol is really well-designed.