I'm not an expert in authentication but afaik TOTP (and HOTP) work completely offline. That means you could store your keys on a device that doesn't have internet access. On that device you can do whatever you want. Some TOTP apps allow you to lock your keys with an additional passphrase or a biometric factor.

From my (maybe naive) POV as a user I tend to agree, it would be nice to have a standard for push-based authentication so that I can actually see when someone else has made it past the password prompt. Although email notifications would largely solve that problem (if more websites used them).