Legacy Show if the user is using two factor authentication

It would be admin-only I think, otherwise this could have security implications.

Imagine if a wannabe hacker noticed that an admin doesn't have the "flag" in their profile, they can then go to their underground websites and search their databases of usernames & passwords for the username of the admin. If the username is unique enough, and there's a match, maybe the admin used the same password on your site as he did on that other site.

In short: The security of your forum may be compromised from just that icon or whatever you had in mind.