If you have any concern I would gladly hear technical insight about the threat model involved. The cross-post on the Privacy communities sparked more conversation if you want to follow up on that point : https://lemmy.ml/post/12744864.

Extension "authenticator" has been around for more than a decade now. I am sharing something that is small, simple, auditable and secure (no permission to do anything but past on clipboard).

There is indeed a whole lot of problems with security and we don't have consensus on a nice/minimum setup. My main concern right now is the physical access to hardware (my place is far from being a vault). Finding my address would not be that big of an issue then getting in would be very easy.

For now having backups in multiple places is the best for me, having physical keys is not solving any on my security concern. The good part is no one cares about my stuff so for now this is OK.