While not 100% open source, I'm a big fan of YubiKey--if you're going to do 2FA, then there is no better solution IMHO.
Discussion
Great product but for the person that will using it they just need to be able to keep track of master keys inside the app without backing anything up to the cloud. I doubt they'll spend even $5 for this use case.
