Most 2FA solutions on commercial websites (bank, online payment, electricity/water/gas providers) require a phone here instead of using open standard solutions or using physical tokens. They are doing everything they can to force us in to a Google/Apple lock in.