See D19976. Currently, bin/auth strip destroys data permanently. It would generally be better to disable configs instead (for auditing, undo, revocation, etc).
There's no technical or product reason that we destroy configs, it was just easier to implement and it's not hugely high-value.
A caveat here: the "Strip MFA" flow in the cluster reaches into the shard database and executes a DELETE ... so that it can execute synchronously. This needs to be made less abrupt if we're moving away from deletes. This isn't too hard, although it may need some UI hinting because it means that the button will change from actually stripping factors to queueing the strip for the daemons, and it may execute an arbitrarily long amount of time later. We may need to give the administrator better feedback about the process.