Unfortunately, this requires a breaking change to IUserAuthenticatorKeyStore. This change would require a non-breaking API proposal and a new IdentitySchemaVersion at a minimum.

Even if this PR did include changes to the EF stores, I would not accept it because I do not think it's worth the complexity of maintaining a new schema and the conditional logic that would entail just to prevent TOTP reuse. Furthermore, the code as proposed has a race condition where the TOTP could be reused anyway. However, if you feel that your application does need protection against TOTP reuse, you are welcome to implement a custom IUserTwoFactorTokenProvider<TUser>.

We have updated our documentation to explicitly warn about this:

Warning: An ASP.NET Core TOTP code should be kept secret because it can be used to authenticate successfully multiple times before it expires.

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-enable-qrcodes?view=aspnetcore-8.0

I acknowledge that this does not follow the RFC or NIST guidelines, but as I mentioned in the issue, the TOTP still offers a lot of additional security over just a password even if it can be used multiple times in a 30 second window. If an attacker can read arbitrary network traffic and sniff the TOTP from the form post, they'd usually be better off stealing the authentication cookie that will last a lot longer than 30 seconds.