Xavi3r supports WebAuthn (FIDO2) compliant security keys like YubiKey. During the process, you can register a physical key that must be inserted and tapped, rendering remote hackers powerless.