[technofiend]

Just thought I'd mention that PayPal recently quietly added TOTP second factor support. It's not u2f but it's better than SMS. Perhaps u2f is in the cards now since they're listening to customer feedback on the issue.