There was a link just 2 days ago on HN [1] about how 2FA has already been forced, but it's a mess b/c every site does it differently and usually in a way that's not secure.
Side question: Do you use your Yubikeys for GPG? I tried to make two identical keys with the same GPG key, but still I get "Please remove the current card and insert the one with serial number: ..." if I try to decrypt a file with the other key. I asked the internet a couple times but no one seems to know.
This is the most important thing. It solves so may other inconveniences of the net. Your username should be your fingerprint. Your password should be 8 characters. You should have a 2fa fob that secures your account. So much less fraud and other attacks. I think this has the highest ROI.