Comment by rustyhancock

Yes it does seem prudent to encrypt those keys some other way on the cloud and not add them to the clouds accessible keys.

They also seem suitable for using a secret sharing scheme.

I have Microsoft authenticator requests all day every day. Using aliases has helped but somehow they continue. It's only a matter of time before somehow accidentally I approve.

Which has simply led to me not putting anything of high value in my Microsoft account and not using it for my email.