Great suggestions all around.

I also avoid the cloud for this type of stuff (so no Bitwarden on someone else’s server). All my disks are encrypted at rest, and I keep the TOTPs both in Keepass and in Aegis. Both are backed up on machines/disks I control (via Syncthing and Seedvault mostly)