Thanks, I think it worked. At least they are no longer asking me to confirm the mobile number, although I can't seem to delete the unconfirmed number so who knows if there is still a way to use it to take over the account :(. Along the way I found a disturbing number of TOTP utilities that want you to pass the key on the command line :(. I found this one as a simple version that doesn't do that and uses OpenSSL or LibreSSL:
