Huh, so I'm stupid I guess, but how is MFA phish proof? Why did Kurt's commit access get revoked?
MFA is not in general phish-resistant. But Passkeys, U2F, and FIDO2 generally are, because they mutually authenticate; they're not just "one time passwords" you type into a field, but rather a cryptographic protocol running between you and the site.