Currently in scope of MultiFactor Authentification on frontend during login, we have only simple warning to store the key somewhere and thats it.

I've encountered a case when system has:

1. only one SuperAdmin  (sounds bad enough but viable for small systems)

1. bunch of users with no access to authentication control

SuperAdmin looses his phone (Device) where MFAthentificator was installed,

SAdmin changes job and on the last day deletes MFAuthentificator (Human factor, error in processes)

the only way now to get into the system

is to gain access to DB and manually delete SAdmin from MFA group or reset his TOTP - this is a back door solution if we have access to DB,

I suggest to investigate a solution for more user friendly MFA recovery tool