Very possibly, but I don't have a phone or a hardware key, and I'm certainly not going out and getting one for the benefit of PyPI, so my choices are?
Having an outdated version of my packages on a locked-out account on PyPI (with the up-to-date sdists that I distribute on my website) sounds like a nightmare.
Having an outdated version of my packages on a locked-out account on PyPI (with the up-to-date sdists that I distribute on my website) sounds like a nightmare.