At work there's a command I run that then requires 2fa auth through our identity provider. As a result, my ssh key gets signed with both a time restriction and

At work there's a command I run that then requires 2fa auth through our identity provider. As a result, my ssh key gets signed with both a time restriction and an ip restriction. Same mechanism for git interactions and server logins. I believe on the backend it's an HSM which does the signing.