Hacker News Reader

GitHub has a "Preferred 2FA method" method that you can set to passkeys.

Yes I know. During normal use it uses it.

But you still can't remove the TOTP and it will keep asking to 'verify' it every month or so.

I don't remember verifying TOTP in months. I'm pretty sure since I setup passkeys. Maybe it's not required if you have three methods setup.