Hardware tokens now can be removed by using the "Hardware token admin" in MFA Admin
Available by default after upgrade.