Comment by lrvick

TOTP is just as phishable as a password and offering it today is as much security malpractice as SMS.

For all their faults, passkeys/webauthn is the future and you can absolutely just use nitrokeys you control, with backups, as you like.