[dheera]

The way this should be solved is for everyone to enable multiple U2F keys in every site and de-register any device or key that is stolen.

Unfortunately many sites suck at this. AWS, Twilio, PayPal all suck.