Yup. Generally I have felt it was probably overkill for the use case I have in mind but I'll take another look, thx

Yeah I was thinking that might be the case, I just wish it was documented more explicitly.Ideally I'm looking for a configuration for specific users at higher risk of phishing, so I'd like to avoid SMS and other flows where they can be socially engin...

Having the same issue here. While testing I was able to get it to work by adding both a passkey and a security key. Once I did that I could enable 2FA, then while 2FA was enabled I was able to remove all but the passkey and it didn't complain.