Hm, does Github not have a way to enforce key-based 2FA across your organization? Seems that users can even set up an SMS backup, which I would love to block.
Conversation
Replying to
Does it even have a way to use security keys without TOTP 2FA enabled? I don't think that's supported.
Google is one of the only services where you even have that option, let alone an equivalent to the Advanced Protection Program.
2
At least Twitter supports it now... but generally not more important things.