I am currently using only virtual. With IAM supporting only a single MFA per account, it created a huge risk to involve a HW token that could be lost. I am tra

I am currently using only virtual. With IAM supporting only a single MFA per account, it created a huge risk to involve a HW token that could be lost. I am transitioning many of my accounts (not just AWS) to hardware tokens and away from TOTP, but it is important to have > 1 token enrolled in case of loss.