A secnod for Yubikeys. We love them. You can load your own key onto them so there is no worries when a third party (like RSA) gets hacked. There are open souce tools to configure them and run authentication servers. Integrated with PAM, and can be used with radius servers. And they are about $25 each, with no expiry date.