I guess there is a trade off here of having strong security but then users being completely locked out or falling back to SMS which defeats the purpose of stron

I guess there is a trade off here of having strong security but then users being completely locked out or falling back to SMS which defeats the purpose of stronger auth like Yubikeys. There should at least be an option to disable SMS for auth. Another option is to call up your telco and ask them to only port a number if you are physically present and verified in a store. This wouldn’t protect against an insider at the telco, but at least common threats.