sounds more simple than Ente's Auth; for instance I can see having a simple totp record-keeping app on an internet-less rpi or similar (or highly restricted networking where an auth'd user can only webui interface with some backup/restore feature when blue-green'ing the device), integrated with some built in (touch)?screen to select/search service-account to read totp from and adding-new via screen as well.

edit: simple in terms of only ever needing to compile/validate the thing for linux (arm + intel)