> another auth step for extra inconvenience and easy of locking yourself out of your accounts I think it depends on the context how one would solve that. For

> another auth step for extra inconvenience and easy of locking yourself out of your accounts I think it depends on the context how one would solve that. For example in our company we made (webauthn) security keys mandatory (as well as 2FA itself) for our internal IdP and disabled all other 2FA methods. All account recovery methods such as SMS, phone, email, etc. are also disabled. If someone looses their key it means they need to go to IT to re-provision a new one in their account. In practice this almost doesn't happen. In return we get a setup in which even less tech-savy people are quite hard to phish. Overall people seem to be pretty happy with the setup. For example they don't need to lookup and enter TOTP codes, they just need to press a button. In Troy's case you might want to use a second (backup) security key.