Onlykey. It’s u2f. And has up to 12 or 24 depending on how you setup username password combinations. It’s got a physical pin required and you can set what happens on 6 failed attempts. Like nuke it’s own firmware and (quantum proof encrypted alg) password and keystore. It requires no software on machine (after setup) so you can use it on machines you don’t own and don’t need to install middleware (I’m looking at you nitrokey) If you use Linux you can use it as a ssh private key and login method requiring challenge response (via its pin pad) (windows support for it is middleware to do this is …not easy). It’s a true one way write… you add a password in all you can do is overwrite never read from it. https://onlykey.io/. Ive been using it my corporate IT day to day for 3 years.
I keep an iodd mini with all the current and past repair isos. Then I have a folder.i keep the tooling income.upmwoth for various repair or automation stuff. I got a batch script (need to move to winger) to auto install all my standard day one software. On mobile otherwise I would pull up the list and throw it in here. If you are curious let me know and I’ll reply with the list when I get time.