Well, you’d be 100% safe of MitM.<p>And you could use a hardware key auth.<p>Like the German eID, where the key is signed by the government and on a special chipcard.<p>The software requests the card to sign, you need to type in your PIN on the reader itself, and the request will be signed with RSA.<p>The public key is world-readable on the card, so you can just send that to the server.