http://www.yubico.com/products/yubikey/

Anyone else interested? They're a hardware authentication token. Think RSA SecureID without having to read or type, much less expensive, and much more entropy. There's a pam module out there for auth, and the manufacturer has a google code project for the utility that you use to change their internal, private key. (They use asymmetric crypto.) I'm probably buying mine in a week, so speak up on list or off if you want one. Count on paying $22 for each. (second cost bracket, plus splitting shipping)

The manufacturer believes in open source, and has intelligent support.