Perhaps, but I don't think it should be a strict requirement. A locked-down, encrypted laptop with all of its keys stored securely in a TPM will do just fine wh

Perhaps, but I don't think it should be a strict requirement. A locked-down, encrypted laptop with all of its keys stored securely in a TPM will do just fine when all you want to prevent is hackers from another country using credential stuffing to log into your online environment. It mostly depends on what kind of threads you're trying to defend against. Then again, with passkeys and Windows Hello/TouchID becoming more and more usable in real life, I think the Authy app has better replacements available that are built right into the operating systems already. The real kicker is Authy's sync feature; you're basically locking your 2FA behind a password and a phone number. It's another thing attackers need to hack, but it's inherently weaker for protecting access than the "hardware you need to destroy to get the secrets" types of second factors.