This should only ever be explicitly removed. Similarly, include an empty array of recovery keys in the tfa challenge, so that clients know about empty recoveries rather than getting an empty challenge when there are no other factors available. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>