If you don't trust the employee's device at all, you shouldn't let them use a keyboard. Even if your authentication is password-free (say, TOTP plus pick-the-r

If you don't trust the employee's device at all, you shouldn't let them use a keyboard. Even if your authentication is password-free (say, TOTP plus pick-the-right-icon from a set of 64), you don't want a keylogger picking up anything else, do you?