Personally I think RADIUS is a terrible idea. If that thing is compromised, or even the network or name service to connect to it, the attacker gets everything.

Personally I think RADIUS is a terrible idea. If that thing is compromised, or even the network or name service to connect to it, the attacker gets everything. Cert-based auth gives every client the ability to independently authorize every login without any ability to learn or compromise credentials. And there are lots of cert-based MFAs that require nothing more than a few lines in an Apache config, or even handled through the operating system to set up a vpn handshake. One of my biggest contributions at one place I worked was to dismantle their radius auth and replace it with token cert auth. It’s hard to write about that on a resume, because people tend to be more impressed with complexity than simplicity.