I think this still has a grace period for trusted devices? Some of the FAQs at the bottom make it sound like you don't need to use the physical key every time you log in.

Which, again, is probably reasonable for 99% of cases, but might be undesirable if you're doing investigative journalism on powerful state actors or some such.