Could we treat them like 2FA codes where you’re responsible for backing up the secret (phrases/words), but could recover it if the correct secret is entered? I know this adds complexity.