Features that I'd like to add:

• Enable / disable TFA through the edit users page on the dashboard thereby negating the need for public profiles to be turned on
• Add a set of single-use "scratch codes" that can be printed out and stored elsewhere to add as a backup second factor in case your phone or secret key is lost
• Add a way to turn off the QR code, or to integrate it into the package to remove the need for the Google Charts API (for security, speed and customization purposes)