When I try to bypass 2FA using my secret phrase or secondary email one time code, not only it deactivates 2FA, it removes all the available security keys saved. I propose to only disable 2FA, to let the user choose if they want to enable it in the future, and let them delete it after only if they want to

Even asking if they want to delete the keys and disabling is a better option than to automatically delete everything