I was looking at something similar a couple of days ago. I think a physical key like a yubi key is a great way to fight bot traffic. And apparently cloudflare already ran project to test this out, and found some small drawbacks. So they proposed CAP together with other orgs https://developers.cloudflare.com/fundamentals/reference/cry...

This might be an extreme case of that, but I can see us going in that direction