Opting out of "codes" (SMS 2FA) is allowed if two U2F keys are registered. Accept U2F keys on mobile instead of trying to reenroll us in old fashioned SMS 2FA which DoD recommends against using at all as insecure.