The two factor where I work, Google, uses security keys for the second factor. I think offering these as an alternative to the email/SMS codes would be nice, tapping a little USB nub isn’t nearly as annoying as grabbing a code from another webpage or device.