Check this[] starting at 18:55. It explains the issue and the fix for OTP/TOTP. What you need is a u2f device/key/app and web auth. It takes the responsibility to identify if the website is fake or not from you which is really the core issue. The secret is negotiated directly with the u2F device/sec key.

https://m.youtube.com/watch?v=kGGMgEfSzMw&time_continue=1271