SSH certificates are a good solution, though I think you could still use longer-lived SSH identities as part of the authentication process to the system that si

SSH certificates are a good solution, though I think you could still use longer-lived SSH identities as part of the authentication process to the system that signs your certificate with MFA on top. I personally really just don't like passwords for authentication at all, and SSH is super convenient to use on top of being secure. Having a solution like that in place goes a long way towards reducing the immediate power you have available at any one time, so I don't think we disagree much at all.