I agree regarding the offline ability, though literally all the things I'm using 2FA for are online, as they are about logging-in to services. As for the 2nd p

I agree regarding the offline ability, though literally all the things I'm using 2FA for are online, as they are about logging-in to services. As for the 2nd point - I definitely don't think it has to be a separate app for each service. Why would it? Imagine an app that holds a private key, the website showing a QR code, you scan it with the app, the app sends the public key to the service using a URL provided in the QR code, and the service stores your public key. From now on, every time you want to login you're asked to scan a QR code, which makes the app send a signed request to the a URL encoded in it. The service gets the request and proceeds with the login. One app, all services.