The first difference can be negated by using an unplugged storage device to store the key. The second one is trickier since you need to do processing to prove

The first difference can be negated by using an unplugged storage device to store the key. The second one is trickier since you need to do processing to prove that you have a private key, so you'd have to send the key to your own computer which breaks the whole point. You could use a separate "key" computer who owns the keys and that computer is the one that proves that it has the private key, but at that point you'd be better off using a normal security key since it's basically the same thing.