It’s worth mentioning that, although hardware keys are increasingly supported, if they are not available, there are usually fallbacks to less secure factors, such as email or phone numbers.

What’s the point of a hardware key then, if email also works?