Certificates
Certificates can cryptographically associate a public key with an identity.
Must be installed on each machine used by each individual.
Fundamentally superior -- secret never shared with any other component.
Can be implemented in tokens.
But -- do they require too much infrastructure?