Admin Account Passwords USB Key

I help manage an all-Mac school with about 200 MacBooks that have been setup over several years by different people. We typically use a few different admin passwords, but sometimes find an older laptop that we simply do not have record of the password. We also have found that students have learned the admin passwords and we need to change them. We began using an MDM last year, but we do not have everything on that system yet. That will likely only be used as laptops are replaced over time.

It is a large undertaking to change the password on all of these MacBooks, but when we do, I want it to be more secure. I would love to require a USB key for admin access, but I have found no solution for doing so. Does such a thing exist? Is there a better way to handle this?