Wouldn't something like a mobile authenticator sort of cover this issue, assuming you have a phone that would allow it? I think instead of doing something awkward like allowing two security tokens, just create a mobile authenticator app. This would also allow people security for free instead of paying the unit price and potential shipping for the security token.