I just want to chip in and say that 2. can be helped somewhat by having a second device (maybe old smartphone on wifi) that you export all authenticator keys to

I just want to chip in and say that 2. can be helped somewhat by having a second device (maybe old smartphone on wifi) that you export all authenticator keys to. Stick the old phone in a safe and make sure it's still working every so often (2x/year?) This is relatively new - a few years ago Authenticator did not support this. Oh, and make sure before you use the emergency device, time is synced - codes won't work otherwise.