Alas, I'm completely unable to get the soft token to work (after enabling it in config:about). It even fail on https://u2f.bin.coffee/ which seems to claim it should work.

It's a usability trade off; I have a physical key, but I'm asked to authenticate 20+ times a day which make it a pain on my port-limited MacBook Pro.