I kind of feel like this is being done already with Webauthn and Passkeys. Another couple years of user's upgrading/updating devices, and the option to use a passkey may be as ubiquitous as using SMS for MFA.
It will take a while but I'm hopeful that Passkeys--some variant of which has been being discussed for well over a decade--will finally get mainstream adoption. I'm not convinced tokens ever will at least outside of particularly high value accounts.
