U2F is immune against phishing.

Here's a brief comparison between OTP (Authenticator) and U2F: https://www.yubico.com/2016/02/otp-vs-u2f-strong-to-stronger...

One big advantage of U2P is protection against phishing and mitm attacks, which OTP is vulnerable to. There is more information here: https://developers.yubico.com/U2F/Protocol_details/Overview....

http://www.dongleauth.info/ maintains a list of sites supporting U2F devices. There aren't many yet, but it looks like a Wordpress plugin exists that may end up in core. There are also a handful of additional sites listed in issues and pull requests on the site's GitHub page (https://github.com/Nitrokey/dongleauth).

(I'm not affiliated with the site, I just check it periodically and thought it might be of use here.)

Bitbucket as well.

Google also supports U2F

You use the customer support backdoor.

You can add multiple keys, so you could have a primary one that's with you and another one that's stored somewhere safe. You can also configure OTP and/or SMS-based 2FA and backup/recovery codes as a fallback mechanism.

I have YubiKey Nanos "permanently installed" in each computer I use, as well as a portable one. If I lose all my computers, and my keys, and my phone... I guess I'll have to make a new Github account. It's all open-source anyway!