That's interesting because most of the ones I've seen work like this: - user created, 2FA token created, user not active - user gets 2FA token via 2nd channel

That's interesting because most of the ones I've seen work like this: - user created, 2FA token created, user not active - user gets 2FA token via 2nd channel - user enters token, gets to create a password for account - user active, token invalidated this isn't airtight - nothing is - but it means either you got the token or you can't log in to your account, which should raise a red flag.