Yubikey is kinda the gold standard IMO. Yes, I know google has their own titan something but the other one I know that can rival yubikey in terms of support and longevity would be nitrokey. Else I recommend making a poor man’s security key using a keyfile and a flashdrive to secure your keepass database
Edit: forgot about nitrokey’s overly sensational claims about a backdoor on Qualcomm chips a while back, that kinda stained my view on their company now. Just get a yubikey sure theres no firmware upgrades and whatnot but its good enough for now. Also heard good things about onlykeys