Non-iterated

(My LDAP comment was aimed at the notion of providing the USB device on cloud services. I don't see how you could get the physical USB device accessible from a cloud without using some networking stuff, in which case LDAP is just easier.)

Regarding the LDAP server being compromised or not, that depends on how well you protect/harden your LDAP server(s). I just don't see USB devices on each host scale very well and single sign-on is pretty much out of the question... Unless you attach your USB device to your LDAP server.

Also, how do you synchronise passwords in a HA environment? Given that the storage on the USB device is not accessible, it means you cannot make backups either. If the USB device breaks, that's it. Game over.

And, of course, you are assuming that the USB device has faultless security, and cannot be compromised itself. You still need to talk to it; over USB rather than IP, but buffers being buffers and programmers being programmers, I'm far from convinced there wouldn't be exploitable holes. Holes that would be that much harder to plug, because the device wouldn't (shouldn't!) allow you to fiddle with the firmware. Compare that to an apt-get/yum update to patch slapd.