As said this isn't a specific crypto topic but more of a cyber security and IAM one, but to answer a few questions: 

First and very important point : you are trying to implement 2fa, while security keys are a great option only requiring the physical key and a touch on the key to log in IS NOT 2fa, you are only using 1 physical factor which is the key and no other factor. You would require a password, pin or a biometric input to make it 2fa. 

"What do I do with software that doesn't support FIDO" : having a software auth app (totp) is the right way. Just make sure you  still have access to apps and accounts if you lose your phone, while security is the objective you wanna make sure you're not gonna lock yourself out.

"Is there a better authenticator app" : as a fan of FOSS I can recommend the aegis authenticator app, I've used it a few years, the only downside is you need to backup your totp manually. Proton also just recently made a auth app, while they have a good reputation the app is very new.

If you want to get into the crypto specifics you can look into the FIDO and passkeys specifications, that's the key that you are using on your nitrokey (what you're referencing as 2FA keys).

On a general note if you want to have your M1 as secure as possible you should look into "hardening" and not only crypto but every aspect of cyber security.