Agreed - if you want true "thing you have", it needs to be a standalone hardware token, and it needs to be fundamentally impossible to extract the key from it.

Agreed - if you want true "thing you have", it needs to be a standalone hardware token, and it needs to be fundamentally impossible to extract the key from it. Otherwise, its key just becomes another "thing you know".