> The only solution here is: hardware 2 factor like yubikeys.

And when that’s lost, what do you do? Aren’t you back to account recovery step?