That's true of any authentication mechanism. It works until it doesn't. If you wanted to work this into a traditional terminal workflow "generateToken my.host &

That's true of any authentication mechanism. It works until it doesn't. If you wanted to work this into a traditional terminal workflow "generateToken my.host && ssh my.host" TOPT is the least worst way of doing 2FA. I wish I lived in a world where this sort of thing wasn't necessary, but if you have a service where there are accounts that are worth a lot of money in the real world, you need to have some kind of 2FA.