I don't use Google Authenticator for TOTP. Instead, I use Aegis which can encrypt private keys and is available in F-droid. It allows offline backup too. I am

I don't use Google Authenticator for TOTP. Instead, I use Aegis which can encrypt private keys and is available in F-droid. It allows offline backup too. I am perplexed about "as good as my Google password": isn't your email verification as good as one of your registrar password, DNS/Cloudflare password and email password? How is this different? With hardware key, losing it only matters if you lost the password at the same time: MFA means multiple factors, so that's a password + MFA. If you are referring to a hw passkey, that might be different. Gaining access to your email server/domain name does not necessarily require Cloudflare to be hacked. It all sounds like you really are not fully understanding the security risks between different options, and that this is really mostly about you not wanting to lose the convenience you have. Which is fine, but again, you should be honest about that (or might need to better evaluate your security posture).