I do rotate which key is off-site. For the "critical sites" this means I've only got two keys registered for some period of time. I don't use the TOTP on the

I do rotate which key is off-site. For the "critical sites" this means I've only got two keys registered for some period of time. I don't use the TOTP on the Yubikeys for most sites so signing up for a new service involves generating a new TOTP key with oathtool and saving that in password-store (along with the URL and login name) when I generate the password.