What bothers me is they all had 2FA in the form of certificates or SMS auth, and most of them moved off of that to some other solution (current bank has 3rd party login which I can do with a cert, the old bank only has an app). What's wrong with cert auth? It can't be less secure than an android app.