How about supporting hardware authentication keys/Yubikey?
nextcloud does it, I think we havent enable it. During next two / three days we are planning on rolling out nextcloud update (now testing it) so we will include hardware 2FA.
We have not yet roll out the nextcloud upgrade, therefor i enabled hw key authentication.
Feel free to test it and give us feedback. (there is a dedicated ubikey app we havent enabled as it requires us to have an account / key on our own to generate api key, though i think the generic auth key app should work).
Check your nextcloud settings (under security) to enable/configure it.