Just use a custom list for them. Or just isolate them on a different vlan.

I mean any single factor authentication is terrible. Two factor is always preferred.

I’m happily using YubiKey, wish everyone implemented U2F

Not an answer but more of a mitigation strategy.

Duck mail proxy and a password manager that uses its API solves a few of the issues.

Phone number is linked to Google voice so I can change it on the whim.

I have a VLAN with a dead gateway

I’m going to need a source on that so I can avoid those kinds of TVs.

No all of your packets will have a destination IP address. Meta data isn’t encrypted for an HTTPS.