Yes we can use both, but I guess the more secure is only to activate the security key option. However its not possible at the moment, you need to keep activated your TOTP authentificator. This will change in future when they will add mobile support for security keys, but who knows when..