Safari is late to the game here, as Firefox launched support for WebAuthn earlier this year, followed shortly by Google with Chrome. Individual sites and apps also support the standard, including Twitter, Facebook and Office 365.
USB key authentication is another option to two-factor systems that use SMS text messages or apps like Duo or Google's own Authenticator. Hardware keys are particularly effective, however -- Google has said that it completely eliminated phishing attacks by equipping 85,000 of its employees with its own Titan Key hardware (above).
That's not to say that they're problem free. You might be in a world of hurt if you lose the key, though the same logic can apply to passwords and other systems. It also requires carrying an extra device, as if you don't have enough keys, dongles and cards already. If you're curious to try it out, however, Safari Preview release 71 is now available for download -- though there's no guarantee, of course, that the feature will be released widely.