That's a more likely explanation for the Github passkey vs TOTP thing too.