I note that nothing specifically seems to migrate scratch tokens from a string to an array
As noted in https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/OATHAuth/+/538154/
https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/OATHAuth/+/538154/11/src/Key/TOTPKey.php@97
Hence the need for some of the defensive code