I pair of hardware keys (Token2, Yubico, etc) has the benefits from both worlds.

Except enrollability. Got a new account? You need physical access to both tokens to enroll it. Got a new token? You'll have to individually enroll every website - provided they even support multiple tokens at all...

Yubikey tried to solve this, for obvious reasons. Their proposal was DOA.