Right, but there's no way to cryptographically enforce that. All the totp implementations I've seen are symmetric, with the validating server running the same calculation from the same seed. You could do that locally - but then the seed can be extracted or a client can be patched to just not request the code in the first place.
That's not true. You can verify the time based codes or do u2f yourself. You don't need a third party for that.