You can have a security key on Google without a phone number, but you have to enroll with a phone number and then remove it. Google won't allow you to remove the phone number unless you have some other backup 2FA method available.
The best Google (actually: everywhere) 2FA "stack" in Q1 2017 is:
1. Hardware U2F
2. Software TOTP (Authenticator app on your phone)
3. Physically secured backup codes
4. Disabled SMS
My experience with the Y4 hardware and, particularly, software has not been great. I'm using the Y4 for SSH access (through ssh-compat mode on gpg-agent) and it's mostly OK, but if I try to use PIV mode on the same token I run into all sorts of problems. I'm bullish on U2F, but bearish on Unix token applications.
The best Google (actually: everywhere) 2FA "stack" in Q1 2017 is:
1. Hardware U2F
2. Software TOTP (Authenticator app on your phone)
3. Physically secured backup codes
4. Disabled SMS
My experience with the Y4 hardware and, particularly, software has not been great. I'm using the Y4 for SSH access (through ssh-compat mode on gpg-agent) and it's mostly OK, but if I try to use PIV mode on the same token I run into all sorts of problems. I'm bullish on U2F, but bearish on Unix token applications.