the key that must refuse to start
A second factor is only as strong as the secret behind it. If the material that protects every enrolled user's authenticator state lives in configuration with a fallback, the control has a quiet ceiling, and the ceiling is whatever the…