Michael: yeah, that's a great suggestion (yubikey). I might use that as part of the system. Relatedly, does anyone I know use http://passwordsafe.sourceforge.net/ ?