@jamesob your change will break code that passes in values without casting them. It will start raising instead of returning False. Given the current API, it is safer to return False instead of raising.

Moreover, it's not a given that OTPs are numeric. See https://www.ietf.org/rfc/rfc4226.txt section E.2.