Wouldn't this be possible to circumvent if the user is allowed to switch TOTP devices? Are you saying you'd like a way to irrevocably tie this to a single TOTP secret? And you're not worried that someone could steal your TOTP secret and you'd be 100% powerless to stop them?
Wouldn't this be possible to circumvent if the user is allowed to switch TOTP devices? Are you saying you'd like a way to irrevocably tie this to a single TOTP secret? And you're not worried that someone could steal your TOTP secret and you'd be 100% powerless to stop them?