Similar to GitLab you seem to require TOTOP 2FA to be setup before I can enable U2F.

Obviously this is a silly requirement, as I should be able to enable what I want and there is no reason to force TOTP to be enabled. Obviously it should still enable the recovery password (you seem to call it "one-time password").

See e.g. how any other website does it.