I've got a 2fa backup code in a DNS entry on a free hosting provider. I've got another hidden in some public source code, masquerading as an example encryption key. There's all sorts of digital hiding places these days. Self signed certificates (serial number, subject, issuer, etc), http headers, etc. Other possibilities are accounts with determinate passwords (eg. a hash of your name) that are used only to store your secrets.