When you set up two-factor, think about the scenario where you lose your phone, keys, wallet/purse and laptop together. Printed single-use security codes and passwords left with a spouse, editor, safe drawer in your home etc. are a hassle, but boy will you be happy you did it.
With passwords, any of a number of backup strategies are fine. Print them out, save an encrypted copy somewhere, keep an emergency device separate from others. The point is to have one that survives the loss of your laptop, phone, and other belongings at the same time.
A nice thing about security keys as two-factor is that they are not only the best defense against phishing, but your key can serve as a backup for others (and vice versa), except on Twitter, where they don't let you register multiple keys to an account.
