Adding a security key to Gmail
I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token.Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link and a security token buys you no added security, only ease of use.The typical goal of a security token is to be able to assert: "No one can log into my account without this physical device or an offline backup token from my safe"To acheive this consider a device with built-in TOTP support in addition to U2F. All current Yubikeys fit the bill here as as well as some Nitrokey models. Desktop or Android users can use the either USB or NFC devices but it is worth noting that iOS lacks support for either which means you would need a desktop or Android device to fetch TOTP tokens for an iPhone.You can use the open source "Yubico Authenticator" apps to store your TOTP secrets in your key alongside your U2F secret. Now both methods use the same hardware and your phone/computer only get handed OTP codes from the key if present, but can't generate them itself.Added bonus is now you can now use security token backed login even on the majority of sites/browsers today that lack U2F support.Extra bonus is these keys can be used for ssh without any server changes. Security token all the things :)