[toomuchtodo]

Yes, 2FA should be mandatory if you’re not using passkeys. This is straightforward to implement.

https://passkeys.directory/