You could still use the TOTP Heads validation method with a phone (currently how it works on Librem laptops with a TPM).