Hardware tokens don't really solve any of the problems I listed. You still have to deal w/ devices that don't do cert auth from a Yubikey (iOS being a great exa

Hardware tokens don't really solve any of the problems I listed. You still have to deal w/ devices that don't do cert auth from a Yubikey (iOS being a great example), so as a site operator you don't get to avoid supporting new device / temp device workflows. Hardware tokens can allow individual power users to solve issues around multiple devices, lost devices, etc themselves, but unless you're suggesting porting 100% of users to hardware tokens, it doesn't change the workflows a site must support.