True, you can't generate a QR code without transmitting the TOTP secret/seed in some fashion, but it's a one-time event that's typically done over HTTPS like yo

True, you can't generate a QR code without transmitting the TOTP secret/seed in some fashion, but it's a one-time event that's typically done over HTTPS like you suggested.