Separate verification
KMAIL asks for your password first. If 2FA is required, a temporary restricted challenge opens on a separate screen.
Recovery and trust
Recovery codes are single-use. Trusted browsers expire and can be revoked under Settings > Security.