Is there a way for Keycloak to disable the deletion of the last 2nd factor a user has, so that the only time the user is without a 2FA is for the (short, in my case) while until they log on the first time?
The context: we have in increasing occurrence of users who, in the case of loss of their 2nd factor, try to be helpful or secure and quickly delete it from their account. But even a stolen or just plain lost 2nd factor is a lot safer than a single factor authentication; it's one of these things that is bleeding obvious once you get told, but is easy to overlook in a stressful situation. The best way to deal with such behavior is to make it plain impossible to remove that last 2nd factor, but I am unable to find any descriptions of how to achieve that in the docs or online. Does Keycloak make that possible?