I am using 2FA with a YubiKey 5 on my admin account. When I try to add an email address and confirm it, I am asked to authenticate with the security key (which is good), but it always results in a Discourse:InvalidParameters error.
Granted, this is quite an edge case, but it has been bugging me for a while now, so I thought I should let you know. I was able to circumvent this by removing the security key and re-adding it after the email confirmed.