How about.. New database table, something like: 2fa_tokens
- 2fa_token_id
- 2fa_token_secret
- 2fa_token_user_id
- 2fa_token_expires
- 2fa_token_last_used
If you check the "Remember me" on the 2FA page you get assigned a 14 day cookie with a token.
When you submit the token as a cookie as part of logging in, the token is checked that it matches one in the 2fa_tokens table for that user ID and isn't expired. If that passes, we skip 2FA for that login. Else, we show the 2FA form as normal.
User would be able to revoke their valid 2FA remember me tokens on the profile page.
Expires tokens are cleaned up by Cron.