No, a TOTP app is also allowed.
https://pypi.org/security-key-giveaway
They're being beyond reasonable. This is outright kind.
No, a TOTP app is also allowed.