I have a family member who had a very junior role at a big finance company 15 years ago and they used hardware keys. Seems like national infrastructure should require similar levels of security.