I have a simple question, around "things that you have" (like sec.
tokens, etc).
Many "fido tokens" (yubi, nitro, google) allow NFC communication, most
computers as well, but i do not find anything in my qubes (maybe the
chips acts as USB client and my USB is down by default?)
=> Is there a solution to that? I am pretty sure I am not the first one
to meditate that question ...
Another, more creative idea could be to use the build-in fingerprint
scanner but feed it artificial "precalculated random fingerprints".
They could work as a second password that you have printed put on a
plastic card (using standard, "fingerprint forgery" ideas, i.e. via a
laser printer in a positive way) and carry it with you; They might even
use as one-time-tokens, if you precalulate a bunch of them 
=> did someone ever hear of such ideas?
thanks, Bernhard