You provide zero information about how this very sensitive information is stored, and how its protected.

So not only do I have to worry about who you are (because I'd essentially be giving you the ability to access any number of services that may not yet have 2FA options) I also have to worry about if that data can be access by someone else who attacks you.