nsec and/or TOTP =best - rest all auths r not privacy friendly or have other issues.