Password reset emails are pretty terrible if not combined with something like TOTP.
So push everyone to start using TOTP. For communication that matters, signing keys is better than nothing.
I know PGP isn't that great, but for now we don't have better. Organizations that care about this are pushing on this, but for "general use" we'll probably never get there.
TOTP gives you better control over risk (good hygiene is achievable), whereas depending on SMS is outsourcing your risk management to low-paid carrier employees.
Like on a piece of paper in a safe. An encrypted database works too.
I wouldn't bet on myself, a technically capable professional, being able to distinguish some of them, especially in a planned attack: for example when trying to login to a dashboard after being woken up by a page middle of the night, I might not notice a homograph attack.
TOTP is better than SMS, both are better than second factor, but it's a great idea to mandate U2F/Webauthn if you can.