Add a passive hardware token using a 3.5mm jack

Use 1-wire bus and any 1-wire chip inside the button. I wrote "any", because each 1-wire chip has its own, unique hardware address, so all that you need on RPi side is checking that the chip was detected, for example using bash command:

ls /sys/bus/w1/devices/

and checking it's output for existence of subdirectory named exactly as this hardware address.

On RPi HW side you need only connect additional jack socket to proper I/O pins (GND + DATA). There is no need to use any power connection here, so it looks to be safest for RPi than similar solution, which uses I2C (I2C needs to have dedicated power line, what makes risk of damage RPi in case of short-circuit).

EDIT: For reliable work you should add the pull-up resistor 4.7kOhm between DATA line and Vcc (3.3V).

You can use most popular and cheap DS18B20 chip, which additionaly provides possibility to measure the room temperature ;), or DS2401, which additionaly provides unique serial number.

I would make each "token" an I2C device. Using a tip-ring-ring-shank style jack would give you 4 conductors -- ground, power, data, and clock. Each token would need to have it's own I2C address, and you would write a function that sniffs out devices on an I2C bus.

This can be done with a set of resistors and capacitor in parallel, each pair with a different RC product. You would turn the gpio output high for a sufficient time, then turn it to an input and measure how long it takes for the cap to discharge. With time constants ranging from microseconds to milliseconds possible , you can distinguish any number of people.