The question of how large the risk is that Google or whoever you pick for SSO will lock you out over some misunderstanding around TOS is the main one I see upth

The question of how large the risk is that Google or whoever you pick for SSO will lock you out over some misunderstanding around TOS is the main one I see upthread, and is pretty tricky. I'm working on follow-up post that gets into this question. I think avoiding the situation you ran into, however, is a very different question. How likely you are to get locked out for security reasons depends a lot on what security configuration you choose. The big risk here is that you set up 2FA and then lose access to your second factor. If someone were to follow the approach I advocate in the post, of always maintaining three registered security keys and adding a new one if you lose an old one, I think the risk of a security lockout ends up being super low.