Google's extra layer of verification to the normal security key model offers a good defense against phishing attacks. But at $50, it's tough to not first look at more affordable options.