The problem with these 2FA systems is that they require access to the 2FA device during enrollment which makes it very inconvenient/impossible to maintain a bac

The problem with these 2FA systems is that they require access to the 2FA device during enrollment which makes it very inconvenient/impossible to maintain a backup device in off-site secure storage as you'd need access to it every time you create a new account. There needs to be a new 2FA standard which only needs the public key of the authentication instrument during enrollment - that way the actual instrument doesn't need to be accessed when creating new accounts and can be kept in secure storage, only accessed in an actual disaster situation.