[shawnz]

> Heck, could even SMS or robodial (Twilio etc) a TOTP code for people without smartphones.

SMS is not secure for this purpose since there are many attacks which allow you to sniff SMS messages.