With a physical key, Google says it can protect you from nation-state hackers