I am on it and like it. It seems to explicitly forbid a bunch of edge cases in the login auth that would otherwise be tricky to configure properly and keep up to date. Yes, you can set up and use hardware key auth without it, but it's nice to guarantee that you can never login without a hardware key no matter what. IIRC it closes off a few other types of misconfiguration or over-authorization that might allow someone to exfiltrate data from your account.