Firstly, while that's technically correct according to the CISSP, it's obviously not actually correct. Two different things I have can absolutely be two factors

Firstly, while that's technically correct according to the CISSP, it's obviously not actually correct. Two different things I have can absolutely be two factors as long as they are not susceptible to the same method of compromise. 1+1=2. Secondly, many password vaults refer to the master password you use to unlock it as the key. Thirdly, many security keys require a pin or similar to be used.