Hi! Verifying possession of the hardware key for authentication purposes is one of the most secure methods available. It allows to mitigate many attacks on Netlify accounts and is more secure than 2FA these days, when 0day attacks on smartphones happen so often.
to provide a bit more rationale… the upstream repositories all support 2FA with hardware keys. the obvious reason for this being that the more important the application, the more you want to prevent modifications via accidentally exposing or intercepting a key. hardware keys are one of the most failsafe ways to accomplish this, hence why github/bitbucket/etc support them.
however when using netlify with these options, netlify becomes the weaker link. having some 2fa is nice, but as long as netlify is providing a lower level of security than the actual commit source/repository, it makes netlify accounts more of a target for things like man in middle or social engineering, simply because of the lower standard applied and the ability to accomplish the same end with less work.
