I've settled on Aegis.

It is open source and allows you to export secrets to an encrypted file which you can copy around.

A bit more tedious than Authy and similar cloud sync solutions but lower attack surface and less tedious to back up than Google Authenticator.

Available on F-droid. Beware of Aegis knock-offs on Google Play Store that use similar name.