I understand the logic of requiring two keys, but why can't I have password + (security key OR single use code). This is what most services support - for something like GitHub I have an authenticator app on my phone or my YubiKey as the second factor, and can use either. That actually provides more redundancy against lost keys/devices than I have now, since if I lose all my Apple devices I'm locked out.