When will you recognize FIDO2 with PIN as two factor in and of itself,
or at least allow an OATH-TOTP compliant 2nd factor? Every other site
that uses FIDO2 security keys with PIN recognizes that's two factors
(something you have + something you know...