A developer at your company is concerned about phishing attacks that trick users into entering their GitHub password and one-time codes on fake login pages. They want a sign-in method that removes the password entirely and is resistant to these phishing attempts. Which GitHub account security option should they enable?