Wireguard, OpenVPN, IPSEC etc are just ways of shuffling packets of data with encryption. What I'm describing is actually a really easy or at least really chea

Wireguard, OpenVPN, IPSEC etc are just ways of shuffling packets of data with encryption. What I'm describing is actually a really easy or at least really cheap way for an organisation to grab an extra factor when authenticating their VPNs. There are loads of howtos (most are completely wank but there are some decent ones) on minting AD SSL certs for users and computers. That's something you "have". You could simply use SSL certs or you could also insist on a username and maybe a password ("something you know"). You use RADIUS because that is a long, long standard way of meditating auth/auth to facility.