[pocksuppet]

This option must have been added later.

[entrope]

U2F was always an option, because I used it since they added the MFA requirement (and like others here never gave Github my phone number). I think TOTP was also available from the start. The warning to not use SMS for MFA might have been added later.

[kirb]

I’ve been using GitHub with TOTP since they added it in 2013, and other non-SMS methods since then. No phone number on my account.