The current 2FA options are repetitive or not supported.
Remove all 2FA options except for two:

• TOTP (Google Authenticator, Authy, etc.)
• Yubikey OTP

Yubikey is currently not implemented but most easy to fix, because it is a simple REST call.

The issue still exists in Version 5.6.25. It was tested in the cloud version.
It doesn't fit maybe right here but account.limesurvey.org should also get the option to use MFA.

We believe the Yubikey story could be on its own ticket.

The Yubikey seems to fit on a different plugin.
1) The user flow for setting Yubikey is a bit different.
Instead of having LS to generate a QR code for inputing in the app, I guess we would need to enter something from the key into LS, right?
2) The token generates from the key I believe has a different validation method.

Also, regarding

Yubikey is currently not implemented but most easy to fix, because it is a simple REST call.

Do you have some docs around it?
We found this, but not sure it is the same as you thought.

As the Yubikey is not implemented, we though of removing that option.
We also though about completing the story just by "removing all 2FA options except for TOTP", but that would leave only 1 option. Is that OK?

@gabrieljenik See https://developers.yubico.com/OTP/Specifications/OTP_validation_protocol.html

As to validate the flow...

When the user sets up 2FA, they must choose between "TOTP" and "YubiKey." If they choose "TOTP," it works the same way as it does today (showing a QR code, the user scans it with their authentication app, and enters the code into Lime). If they choose "YubiKey," instead of displaying a QR code, we only show an input field where the user "writes" the code generated by their YubiKey (by tapping it).

For this initial setup, we first need to validate the code against YubiCloud and then store the Public ID (the first 6 characters of the code).

The Public ID would be stored in the "secretKey" field of the "twoFactorUsers" table (the same field used for TOTP) and would be used during each login to verify that the entered code matches that user.

To validate the code, we need to make a request like this:

https://api.yubico.com/wsapi/2.0/verify?id=${clientId}&otp=${otp}&nonce=${generateNonce()}

For example:

https://api.yubico.com/wsapi/2.0/verify?otp=vvvvvvcucrlcietctckflvnncdgckubflugerlnr&id=87&timeout=8&sl=50&nonce=askjdnkajsndjkasndkjsnad

This same validation needs to be performed at each login with the code entered at that moment.

Now... to perform this validation, we need the Client ID. And from what I understand, this Client ID is something that must be configured at the plugin level, and in order to obtain it, the admin also needs a YubiKey. Is that correct?

Yes, when you sign up for the API at https://upgrade.yubico.com/getapikey/ you get a Client ID and a Secret Key.
THe client ID is used in the URL and the Secret Key is to HMAC sign the request, as far as I understood. (the h param)