Possible to fix "usergroup" to swekey?

Is it possible to do the following:
a) create a special user-group (say 'members'), such that every user of this group *has* to use a SweKey for authentication?
If a user would be added to this user-group, he would have to register a Swekey on the next login (alternatively the admin would have to register the key on changing the group) and the user would not be allowed to remove his key. (Alternative: disallow users from removing their key, let only admin/special users manage the keys). In addition a user would have to login using *both* a password and the key.
Use-case: A website that provides services for authenticated users (e.g. subscription services) and additional services for members (which get a Swekey).

or

b) let users login with or without Swekey, but limit special uses (e.g. voting or any special rights of a given user group) to the presence of their Swekey

I would prefer to use alternative b), but I am not sure whether the Drupal user management supports something like this.