Many organizations are moving to 2FA/MFA

> I'm glad Github etc are going to require them. I even have my Github account set up to require touching the token when pushing, and I got used to that pretty fast.

Is that something that you can set on your account or is it more that you only use `sk-` SSH keys?

If it is via token-anchored keys, how do you manage backup keys (I have…a few)? Do you just have N SSH keys registered or is there a way to make N keys unlock a single SSH keypair? (I really want to avoid "add new token's key" to every service if/when I get new ones because I prefer to manage a keypair per service as well and making that an NxM matrix sounds…horrendous[1].) I'm also worried about exhausting the key storage on the token (IIRC, an older method used up "slots" on the key, but docs about `sk-` keys don't mention hardware limits).

[1] You also end up with a O(n) configuration with `IdentitiesOnly` and leaks how many backups there are directly in the configuration.