Comment by Nzen

Github requires [0] the first 2FA mechanism to be totp or sms. Thereafter, you can add a webauthn compatible hardware key.

[0] https://docs.github.com/en/authentication/securing-your-acco...