Replying to myself here. I've asked Namecheap to consider it (as I'm sure many others have too) but received to ETA. I'd really like to stay with them but lack of U2F is becoming a deal breaker for me, considering how prevalent phone account hijacking has become recently.