Github requires [0] the first 2FA mechanism to be totp or sms. Thereafter, you can add a webauthn compatible hardware key.
[0] https://docs.github.com/en/authentication/securing-your-acco...
[0] https://docs.github.com/en/authentication/securing-your-acco...
2FA is often used as an excuse to obtain more PII from people, and to verify your identity, as a whole. Most businesses want to match logins to individuals, not roles. And that's what 2FA provides them.