I'd use a pair of yubikeys but that's just because I already have them. and I say pair cuz I don't want to rely on a single yubikey that could get lost or stolen or damaged
also I would want there to still be a password required, not just plugging in a hardware token (tho this may be implied)
I agree about needing a backup hardware token (or paper recovery key) to restore access if the primary hardware token is lost or broken.
Also agree about requiring a passphrase.
Any specific recommendations on protocol or setup steps?
nope! I only use a passphrase, no experience to draw from to make recommendations