Everything runs locally.
Single-use backup codes for 2FA.
Configure the format, then generate one-time backup codes locally.