Se have mfa requirements at work as well. Right now we have our private keys in yubikey and unlock them to ssh agent every 12 hours. Sudo is done with agent passing (ssh -A) . We are looking into transitioning to signed ssh keys and hashicorp vault.