AFAIK the simpler option has been 16 character passwords entered by 2 people physically at the same console. IMO TOTP or even U2F have serious over the shoulde

AFAIK the simpler option has been 16 character passwords entered by 2 people physically at the same console. IMO TOTP or even U2F have serious over the shoulder and grabby partner kinds of problems compared even to needing to type with semiprivacy. Technically, in PAM, etc you could always add multiple rules.. But mostly this devolves into RBAC with separate roles so 1 type of admin does each step, but an absent admin is replaceable with another of the same type. I tried to push a change/publish approach over a more traditional RBAC approach once, but it didn't fly.