[birksherty]

Almost nobody in the world have physical key and they shouldn't need to buy one when 2fa apps are sufficient for most people.

[fmajid]

TOTP doesn’t protect against phishing, U2F keys do. Sadly very few companies have them as an option, which goes to show how 2FA is mostly security theater at all but a handful of companies.