It should probably still be able to be reset even when tfaoff.flag is present, since the user may need to use tfaoff.flag to disable sentry temporarily while resetting their device - especially if another admin user is not available to do it for them.
It should probably still be able to be reset even when tfaoff.flag is present, since the user may need to use tfaoff.flag to disable sentry temporarily while resetting their device - especially if another admin user is not available to do it for them.