yep this is the way

True. PSA: if you want the convenience of something like Authy, but with an open source e2e approach: there’s Ente Auth. I’m using it since about a month.

https://github.com/ente-io/auth

EDIT: I also successfully used this (very hacky) approach to extract all my TOTP secrets from Authy (which they normally don’t allow), brought them into the correct format with a small powershell script and imported them successfully into Ente Auth. But beware: it’s really really hacky.

Agreed, don't do this. If your system is compromised, then the moment you unlock your Keepass database, even just once, the attacker now has both your passwords and your TOTP keys and can impersonate you anywhere.

Where I work we are phasing out TOTP in favour of FIDO2 keys, and the ability for users to store TOTP keys in a password database alongside their passwords is one of the key reasons.