Yubikeys are the best of both worlds if you can get them — work paid for mine, but they’re my keys, not theirs, so I can use them for personal accounts as well as work accounts, and not have to worry about them being bound to a work device or insecure from being synced keys in a password vault.