While I agree with your points regarding the security of TOTP / SMS, and I do push for hardware keys at work, I think a case could be made for a mixed use for "

While I agree with your points regarding the security of TOTP / SMS, and I do push for hardware keys at work, I think a case could be made for a mixed use for "regular people". Maintaining two hardware keys is an absolute PITA, especially if you go down the route of storing one off-site, hence not having it with you to enroll when you get a new account. What I do, is use the hardware token as the "main" factor and use the TOTP if for some reason I don't have the token (I may sometimes forget it at home when I'm at my parents' house). The point is that, since I usually have my key, if I'm presented with a Google or whatever prompt for a TOTP, I know something's fishy. I don't normally use that, so I'll investigate why that happens and won't just go ahead and type my code in there.