When I had 2FA enabled, using Google Authenticator, and had to reset my phone, I was locked out of AWS. No backup codes. No texting. Nothing. Had to send in a ticket and get a callback.
It stores your secrets in plain text on the phone without any secure enclave. If your backup password is sniffed or there is a flaw in Authy or your mobile OS sandboxing fails you are toast.
With Yubico's authenticator, you store the secrets ontp your Yubikey. This means you can reset your phone and still be able to use the same TOTP shared secrets. Or if that matters, ask a friend to install the app and use your Yubikeys to get the TOTP.
I use Authy to manage my 2FA codes, but I rarely ever use the desktop app. I stick to my phone to keep a physical separation between my logins and my 2FA app.
I also started storing my backup codes as a base64 encoded gpg password encrypted text file in my password manager. If I ever lose my 2FA codes I can still get into my accounts in a emergency while also protecting myself from a password manager hack.
It's annoying, but as I said, I'm not willing to take the risk.
Convenience is the enemy of security. I think you're making a good choice though. It's a minor inconvenience for increased security and peace of mind.
If my 1Password vault is breached, I am pretty much in a world of trouble as it is.
I have to remember three passwords (oh no!) and feel safer for it. It could all be in my head, though.
If someone gets into your 1Password it’s all over anyway.
That said, I pay for the standalone app and store my vault myself. I have no actual reason not to trust AgileBits hosting it, but they must be a huge target and I’m not taking my chances.
I used to be a Keychain + Authy user but moved everything to 1Password.