[jsnell]

Require use of U2F security keys for the second factor. The whole point of them is that they're unphishable.