I think that TOTP in combination with email is a better way to use TOTP.
It is not as secure as using an app or SMS.
But players would not have to install an external app that could be malicious,
server owners don't have to pay for an Apple developer account just to host one app and server owners don't have to pay for SMS costs.
TOTP with email is easier to use.
Especially because every owner of an premium account and almost every user of the internet already has an email address. And for server owners it's easier to maintain.
Yes, exactly that, that only the group/user with that permission is forced to register and to login every time they join since.
I didn't knew that it was possible to protect commands :D.
That's a really cool feature and is certainly useful.
I'm going to use it in combination with PEX and CommandKits.
It's main function is to allow normal players
to see when a staff-member is able to use
their special permissions
(using a slightly different prefix and a broadcast.)
It is a great improvement in security and fairness.