You missed part of the WiKID authentication process, perhaps because it was not really demonstrated here.  The user enters a PIN (something they know) in the WiKID software token (something they have, well technically, possession of the private key embedded in the token).  The PIN is encrypted and sent to the WiKID server behind the corporate firewall. If the PIN is correct, the account active and the encryption valid, an OTP is generated, encrypted and returned to the user to use as the password.

 You can think of WiKID as being like PGP, but used to transmit authenticating information.  It is 'stronger' than certs or keys, because the PIN is validated on the server rather than locally and integration is simple because every UI supports and username/password combo.  

The addition of the OTP makes SSH more suitable in organizations facing compliance (PCI, etc).