If you're going the Smart card route you can get the PIVKey C910 on Amazon for $15/ea. in quantities of 1. You can also buy them for about $0.10/ea on AliExpress, and then load CoolKey or some other applet.
I forgot to mention that also, of course, CoolKey is open source and the CoolKey PKCS#11 module supports the CoolKey applet (obviously) and makes some attempts to support the US DOD CAC and the US Government PIV -- though I don't know how successful they are. Bugs and feature limitations in CoolKey led me to write CACKey.
The PIVKey C910 complies with NIST SP-800-73 (PIV) -- same as YubiKey PIV mode, so OpenSC supports it. Also, the middleware I wrote (CACKey) is open source and supports it and works on macOS as a tokend driver.
